exploit the possibilities

Pro Clan Manager 1.4.2 SQL Injection

Pro Clan Manager 1.4.2 SQL Injection
Posted Nov 23, 2011
Authored by Darren McDonald

Pro Clan Manager version 1.4.2 suffers from bypass, remote SQL injection and weak password generation vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
MD5 | dbc07fcfe2e6d25903c27b4c7d8d699a

Pro Clan Manager 1.4.2 SQL Injection

Change Mirror Download
Pro Clan Manager, Multiple Vulnerabilities

===============
Document Details
===============
Version 1.0, 2011-11-19

===============
Background
===============

"The aim of Pro Clan Manager is to create an international content
management system dedicated to helping Clans or Guilds work together
and have a good looking website that is W3C valid." [1]

Both of the listed issues can allow unauthenticated users with zero
knowledge to gain administrative access to the application. This
includes permissions to upload arbitrary files such as PHP scripts.

===============
Versions
===============

Version 1.4.2 was tested, the author has decided to officially
discontinue the project in response to these issues. Users should
uninstall the software as soon as possible, before finding a
replacement.

===============
Finding 1 - SQL Injection
===============

Description

The application performs input validation using the $post->Text method
throughout the application on strings to be used in dynamic query
construction. These fields do not appear to be vulnerable to SQL
Injection.

However the $post->LoginFilter uses eregi to ensure non-alphanumeric
characters are not present in the login field. eregi expects a c-style
null terminated string, and will not proceed beyond the first null
byte it encounters. By prefixing a SQL injection attack string with a
null byte this filtering can be bypassed.

The following attack string can be used in the login field to access
the system as the administrator.

notarealuser%00'+union+select+1;#

This needs to be enter as raw HTTP.

===============
Finding 2 - Poor Random Password Generation
===============

Description

Line 302 in includes/user.php generates passwords for new users and
users which have their passwords reset by an administrator.

$password = substr(md5(rand(10000,99999)), 5, 8);

While the passwords generated by this code appear random, it's fairly
obvious from the snippet above that this code is only capable of
generating a maximum of 90,000 unique passwords.

A list of these passwords can be easily constructed, which when used
during an automated attack took around 15 minutes on average to
successfully guess a random password.

A complete list of passwords can be obtained from the following URL,
http://dmcdonald.net/pcm-passgen.php.

===============
References
===============

[1] Pro Clan Manager Source Forge Page,
http://sourceforge.net/projects/autoweb/, Accessed 2011-11-19

===============
Links
===============
http://dmcdonald.net/?page_id=51 - The latest version of this advisory
http://dmcdonald.net/pcm-passgen.php - A script to generate a complete
list of possible random passwords
http://dmcdonald.net/pcm-passgen.txt - The source code for pcm-passgen.php
http://www.proclanmanager.com - The Pro Clan Manager website

-----
Renski
aka Darren McDonald
http://dmcdonald.net
M6LUL

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    24 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    7 Files
  • 4
    Oct 4th
    4 Files
  • 5
    Oct 5th
    10 Files
  • 6
    Oct 6th
    1 Files
  • 7
    Oct 7th
    21 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    5 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    17 Files
  • 12
    Oct 12th
    4 Files
  • 13
    Oct 13th
    4 Files
  • 14
    Oct 14th
    15 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close