AOH :: HP Unsorted W :: BU-1267.HTM

WSCreator 1.1 Blind SQL Injection



WSCreator 1.1 Blind SQL Injection
WSCreator 1.1 Blind SQL Injection



WSCreator 1.1 Blind SQL Injection

 Name              WSCreator
Vendor http://www.wscreator.com 
 Versions Affected 1.1

 Author            Salvatore Fresta aka Drosophila
Website http://www.salvatorefresta.net 
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2009-12-15

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX


I. ABOUT THE APPLICATION

Based on one of the world's leading structure  and content
management systems - WebSiteAdmin, WSCreator  (WS standing
for WebSite) is powerful application for handling multiple
websites. This is a commercial application.


II. DESCRIPTION

The email  value is not properly sanitised  when an INSERT
query  is  used and  this is  the cause of  the  Blind SQL
Injection.


III. ANALYSIS

Summary:

 A) Blind SQL Injection

A) Blind SQL Injection

Like I wrote previous, the email field is not properly san
itised, infact if you try to insert an "'", you will obtain
a SQL error message like the following:

You have an error in your SQL syntax; check the manual that
corresponds  to  your  MySQL  server  version for the right
syntax to use near ''','127.0.0.1','1260844198','error','')

The module affected is ADMIN/loginaction.php at line 2.
As you can see, that is a INSERT SQL syntax.

In  order to  exploit  this vulnerability,  the flag Magic
Quotes GPG (php.ini) must be Off.


IV. SAMPLE CODE

username: ',(SELECT BENCHMARK(99999999, MD5(0x90))),'','','')#
password: foo


V. FIX

No Fix.

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.