what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Pro Clan Manager 1.4.2 SQL Injection

Pro Clan Manager 1.4.2 SQL Injection
Posted Nov 23, 2011
Authored by Darren McDonald

Pro Clan Manager version 1.4.2 suffers from bypass, remote SQL injection and weak password generation vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
SHA-256 | 005e2c07a10cf206d52670cc4946f18b4b7f9c85ee4817ec4cd4cbdffae2ce6d

Pro Clan Manager 1.4.2 SQL Injection

Change Mirror Download
Pro Clan Manager, Multiple Vulnerabilities

===============
Document Details
===============
Version 1.0, 2011-11-19

===============
Background
===============

"The aim of Pro Clan Manager is to create an international content
management system dedicated to helping Clans or Guilds work together
and have a good looking website that is W3C valid." [1]

Both of the listed issues can allow unauthenticated users with zero
knowledge to gain administrative access to the application. This
includes permissions to upload arbitrary files such as PHP scripts.

===============
Versions
===============

Version 1.4.2 was tested, the author has decided to officially
discontinue the project in response to these issues. Users should
uninstall the software as soon as possible, before finding a
replacement.

===============
Finding 1 - SQL Injection
===============

Description

The application performs input validation using the $post->Text method
throughout the application on strings to be used in dynamic query
construction. These fields do not appear to be vulnerable to SQL
Injection.

However the $post->LoginFilter uses eregi to ensure non-alphanumeric
characters are not present in the login field. eregi expects a c-style
null terminated string, and will not proceed beyond the first null
byte it encounters. By prefixing a SQL injection attack string with a
null byte this filtering can be bypassed.

The following attack string can be used in the login field to access
the system as the administrator.

notarealuser%00'+union+select+1;#

This needs to be enter as raw HTTP.

===============
Finding 2 - Poor Random Password Generation
===============

Description

Line 302 in includes/user.php generates passwords for new users and
users which have their passwords reset by an administrator.

$password = substr(md5(rand(10000,99999)), 5, 8);

While the passwords generated by this code appear random, it's fairly
obvious from the snippet above that this code is only capable of
generating a maximum of 90,000 unique passwords.

A list of these passwords can be easily constructed, which when used
during an automated attack took around 15 minutes on average to
successfully guess a random password.

A complete list of passwords can be obtained from the following URL,
http://dmcdonald.net/pcm-passgen.php.

===============
References
===============

[1] Pro Clan Manager Source Forge Page,
http://sourceforge.net/projects/autoweb/, Accessed 2011-11-19

===============
Links
===============
http://dmcdonald.net/?page_id=51 - The latest version of this advisory
http://dmcdonald.net/pcm-passgen.php - A script to generate a complete
list of possible random passwords
http://dmcdonald.net/pcm-passgen.txt - The source code for pcm-passgen.php
http://www.proclanmanager.com - The Pro Clan Manager website

-----
Renski
aka Darren McDonald
http://dmcdonald.net
M6LUL

Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close