Title: ====== RheinMetall AG - Multiple SQL Injection Vulnerabilities Date: ===== 2012-01-17 References: =========== http://www.vulnerability-lab.com/get_content.php?id=170 VL-ID: ===== 170 Introduction: ============= -> UK Rheinmetall AG is a German automotive and defence company with factories in Düsseldorf, Kassel and Unterlüß. The company has a long tradition of making guns and artillery pieces. The company is also involved in a variety of advanced metal-working and milling technologies, allowing it to provide special high-quality components for small arms in addition to heavy weapon production. * A traditional company with 20,000 employees worldwide * Market leader in its core competencies * EUR 3.4 billion annual sales (2009) (Copy of the Vendor Homepage: http://en.wikipedia.org/wiki/Rheinmetall) -> DE Rheinmetall ist im Jahr 1889 als Rheinische Metallwaaren- und Maschinenfabrik Actiengesellschaft gegründet worden. Heute steht die Rheinmetall AG für ein substanzstarkes, international erfolgreiches Unternehmen in den Märkten für Automobilzulieferung und Wehrtechnik.Im Bereich Automotive hat sich die Führungsgesellschaft Kolbenschmidt Pierburg AG mit ihren Geschäftsbereichen KS Kolbenschmidt, Pierburg, KS Aluminium-Technologie, Pierburg Pump Technology, KS Gleitlager und Motor Service auf Module und Systeme rund um den Motor spezialisiert. Für die aktuellen und künftigen Anforderungen der Hersteller werden innovative Lösungen in den Bereichen Schadstoffreduzierung, Verbrauchsminderung, Leichtbau und Leistungs-optimierung entwickelt und vertrieben. Die Defence Sparte des Rheinmetall Konzerns zählt mit ihren Geschäftsbereichen Fahrzeug-systeme, Waffe und Munition, Antriebe, Flugabwehr, Verteidigungselektronik sowie Simulation und Ausbildung zu den namhaften und großen Adressen der internationalen Verteidigungs- und Sicherheitsindustrie. * Traditionsunternehmen mit 20.000 Mitarbeitern weltweit * Marktführer in seinen Kernkompetenzen * 3,4 Mrd EUR Jahresumsatz (2009) (Copy of the Vendor Homepage: http://www.rheinmetall.de/) Abstract: ========= An anonymous researcher of the Vulnerability-Lab Team discovered multiple critical SQL Injection Vulnerabilities on the famous RheinMetalll AG Vendor, KSPG & Defense Website. Report-Timeline: ================ 2011-01-09: Vendor Notification 2011-02-25: Vendor Notification 2 2011-03-16: Vendor Notification 3 2011-**-**: Vendor Response/Feedback 2011-01-06: Vendor Fix/Patch by VLAB Check 2012-01-17: Public or Non-Public Disclosure Status: ======== Published Affected Products: ================== Exploitation-Technique: ======================= Remote Severity: ========= Critical Details: ======== Multiple SQl injection vulnerabilities are detected on the official website of Rheinmetall & RDefense. Remote attackers can execute own sql commands via injection to compromise the web server or the affected dbms. Successful exploitation can result in sensitive information steal by dumping all application web databases of the main , kspg & defense website. Vulnerable Module(s): [+] contact.php [+] index.php [+] jobinfo.php [+] index.php [+] print.php Vulnerable: [+] ?lang= [+] ?id= [+] ?gid= [+] ?jid= [+] ?fid= Affected Domains: [+] rheinmetall.com [+] hrp.rheinmetall.com [+] rheinmetall-defence.com [+] KSPG AG & all Offices Websites (http://www.kspg-ag.de/index.php?fid=119&lang=de) --- Exception Logs --- You have an error in your SQL syntax near -* at line 1 You have an error in your SQL syntax near -*-at line 1 -- You have an error in your SQL syntax nearand cms_release=1 and cms_trash=0 and cms_syscat=0 order by cms_order -*at line 1 -- You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-*at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0-* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -*and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1You have an error in your SQL syntax near -* and cms_release = 1 and cms_trash = 0 and cms_syscat = 0 -* at line 1 -- Warning: Cannot modify header information - headers already sent by (output started at /usr/local/etc/httpd/htdocs/www.kspg-ag.de/cgi-bin/lib.inc.php:99) in /usr/local/etc/httpd/htdocs/www.kspg-ag.de/index.php on line 37 -- Unknown column -* 10 -* in -*order clause -* You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near -*and basic_country_id= and basic_berufsgruppe=-* at line 1You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near -* at line 1You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near -* at line 1 DB User: cmshrp -*@-*localhost DB Schema Name: db_cms_hrp.[tablename] Pictures: ../1.png ../2.png ../3.png Proof of Concept: ================= The vulnerabilities can be exploited by remote attackers without user inter action. For demonstration or reproduce ... remote sql-injection test requester