deV!L`z Clanportal - SQL Injection [061124a]
/ -[061124a]- \
| deV!L`z Clanportal - SQL Injection |
\ /
S Y N O P S I S /
================='
-( access: remote severity: high )-
An SQL injection has been found in deV!L`z Clanportal, which allows any logged
in user to grant herself admin privileges in the system.
B A C K G R O U N D /
====================='
deV!L`z Clanportal (short "DZCP") is a suite of PHP scripts that allow anybody
to create a feature-rich website for her online gaming clan.
A F F E C T E D V E R S I O N S /
==================================='
verified on: 1.3.6
possibly vulnerable: <= 1.3.6
fixed in: 1.3.6.1
I M P A C T /
============='
The attacker gains admin privileges in DZCP and is thus able to create and
download a MySQL dump, upload files, post news, delete users etc.
P R E R E Q U I S I T I E S /
============================='
o the attacker needs to have an user account in the suite and be logged in
o php.ini directive "magic_quotes_gpc" has to be disabled
D E S C R I P T I O N /
======================='
sites/index.php is not escaping the $_GET['show'] parameter, leading to an SQL
injection. This can be used to pass any string to the $where parameter in
DZCP's page() function. page(), in turn, is not checking that parameter,
allowing a second SQL injection in an UPDATE statement on the "users" table to
change arbitrary attributes in the calling user's tuple, including the "level"
attribute, which, set to 4, grants the user administrator privileges.
W O R K A R O U N D /
====================='
Some possibilities:
o Add a mysql_real_escape_string() around the $_GET parameter in the SQL query
in sites/index.php.
o Remove sites/index.php or make it inaccessible.
o Quit using DZCP. I mean it! There are tons of other vulnerabilites just
waiting to be exploited; some of them more severe than this one. IMHO, DZCP
is just a chaotic bunch of vulnerabilities that, by some coincidence, happen
to look like a clan portal.
P R O O F O F C O N C E P T /
================================='
Check if magic_quotes_gpc is enabled:
http://<dzcp>/sites/index.php?show='
If a MySQL error appears or the script dies, it is disabled. Then:
http://<dzcp>/sites/index.php?show=-1'+%55NION+%53ELECT+1,+'Admin+Panel\',+level%3d4,+waffe%3d\'SQL+Injection',+2,+3,+'
T I M E L I N E (CET) /
========================'
2006-11-23 23:05 started searching
24 0:35 exploited
14:20 advisory finished
17:31 informed vendor that any user can get admin privileges
25 23:00 full disclosure to vendor
27 14:36 hotfix available on vendor website
12-01 10:00 full disclosure to the general public
A B O U T T H E A U T H O R /
================================='
Tim Weber, computer science student at the University of Mannheim, Germany,
currently looking for an internship at some IT security or pentesting company,
can be reached via e-mail: scy-adv-061124a at the host scytale.de.
T H A N K S /
============='
o Kallista
o yorn for showing me DZCP and the basics of SQL injections
o the DZCP authors for the fun in secure.php