what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

phplivehelper-sqlexec.txt

phplivehelper-sqlexec.txt
Posted Aug 18, 2008
Authored by James Bercegay | Site gulftech.org

PHP Live Helper versions 2.0.1 and below suffer from SQL injection and code execution vulnerabilities.

tags | exploit, php, vulnerability, code execution, sql injection
SHA-256 | 46230141253c1f845832295a25c7d9fcc09dda0b4e82d2a14406407c4d68c9bf

phplivehelper-sqlexec.txt

Change Mirror Download

##########################################################
# GulfTech Security Research August 16, 2008
##########################################################
# Vendor : Turnkey Web Tools, Inc
# URL : http://www.turnkeywebtools.com
# Version : PHP Live Helper <= 2.0.1
# Risk : Multiple Vulnerabilities
##########################################################


Description:
PHP Live Helper is an online support system written in php that
allows the visitors of a website to interact in real time with
the site owners. There are a number of issues in PHP Live Helper
that allow for several different attacks such as SQL Injection,
Variable Overwriting, and remote code execution. The issues
require no authentication to exploit, and users are encouraged
to upgrade as soon as possible.



SQL Injection:
There are a number of SQL Injection issues in PHP Live Helper
that allow for an attacker to have arbitrary access to database
contents such as administrator credentials. First, let's have a
look at global.php @ lines 51-60

function get ($table, $id, $from="id") {
$result=$this->DB_site->query_first("SELECT * FROM ".
$this->dbprefix.$table." where ".$from."='$id'");
if (is_array($result)) {
foreach ($result as $key => $val) {
$info[$key] = stripslashes($val);
}
}
return $info;
}

As we can see in the above code, all of the parameters passed to
the get() function are unsanitized. So, if the data is not sanitized
before being sent to get() we have an SQL Injection issue.

/onlinestatus_html.php?dep=-99' UNION SELECT 1,2,3,4,5,6,7,8 FROM
admin_accounts WHERE id=1 AND MID(password,1,1)=concat(char(50))/*

An example of the vulnerable function being called can be seen in
onlinestatus_html.php @ line 19. As a result a url like the one
above can be used to enumerate the admin password for the PHP Live
Helper installation. If there is a match to the specified character
you will see an sql error, otherwise you will see an image file.



Arbitrary Variable Overwriting:
PHP Live Helper is vulnerable to a limited Variable Overwriting issue
due to some faulty register globals emulation code. The vulnerable code
in question can be found at libsecure.php @ lines 400-414

unset ($_GET[abs_path]);
$rg = ini_get ('register_globals');
$getget_count = @count ($_GET);
$getget_keys = @array_keys ($_GET);
for ($i = 0; $i < $getget_count; ++$i)
{
$getget_name = $getget_keys[$i];
$getget_value = $_GET[$getget_keys[$i]];
$_GET[$getget_name] = strip_tags (urldecode ($getget_value));
if ($rg == 1)
{
$$getget_name = strip_tags (urldecode ($getget_value));
continue;
}
}

The above code shows that variables can be overwritten, but because
of where it is called, only variables from within the db config file
can be overwritten (database info, and language file setting). This
is enough though to allow an attacker to execute arbitrary code on the
server by overwriting the table prefix variable with an arbitrary SQL
query in order to gather the location of report files, and then
overwriting the language file so that the report containing the
malicious php code is included and executed. The odd thing is that this
registers global emulation code is only called when register globals is
already on, so it is kind of pointless.



Arbitrary Code Execution:
A different bit of code is set to run when register globals are off. The
code in question is located in /includes/globalsoff.php and attempts to
emulate register gloabls by recursively creating variables based on the
GPC super globals. The problem is that all of the variable creation is
done using eval() and thus allows for remote code execution.

/chat.php?rg=0&test=";phpinfo();exit;//

A url like the one shown above will successfully execute the specified
arbitrary php code. It should be noted that by setting rg=0 an attacker
can have this code ran regardless of register globals settings since if
globals is on you can influence the "rg" parameter, and if it is off,
the script runs as intended.



Solution:
The TurnKeyWebTools developers have addressed these issues in the latest
version of PHP Live Helper which can be found at the following url.

http://www.turnkeywebtools.com/esupport/index.php?_m=news&_a=viewnews&newsid=62



Credits:
James Bercegay of the GulfTech Security Research Team



Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00124-08162008
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close