GeheimChaos多个SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1193842 漏洞类型 SQL注入
发布时间 2006-08-14 更新时间 2006-08-15
CVE编号 CVE-2006-4118 CNNVD-ID CNNVD-200608-210
漏洞平台 N/A CVSS评分 5.1
|漏洞来源
https://cxsecurity.com/issue/WLB-2006080085
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200608-210
|漏洞详情
GeheimChaos0.5及早期版本存在多个SQL注入漏洞,远程攻击者可借助以下参数执行SQL指令:(1)提交到(a)gc.php脚本的Temp_entered_login参数或(2)Temp_entered_email参数,以及(b)include/registrieren.php脚本中的多个参数,可能涉及(3)$form_email,(4)$form_vorname,(5)$form_nachname,(6)$form_strasse,(7)$form_plzort,(8)$form_land,(9)$form_homepage,(10)$form_bildpfad,(11)$form_profilsichtbar,(12)$Temp_sprache,(13)$form_tag,(14)$form_monat,(15)$form_jahr,(16)$Temp_akt_string,(17)$form_icq,(18)$form_msn,(19)$form_yahoo,(20)$form_username,和(21)$Temp_form_pass变量。
|漏洞EXP
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
      Advisory: GeheimChaos <= 0.5 Multiple SQL Injection Vulnerabilities
  Release Date: 2006/08/04
 Last Modified: 2006/08/03
        Author: Tamriel [tamriel at gmx dot net]
   Application: GeheimChaos <= 0.5
          Risk: Moderate
 Vendor Status: not contacted
   Vendor Site: www.chaossoft.de

Overview:

Quote from www.chaossoft.de:

"Sofern Sie einen privaten Bereich in Ihre Homepage einbauen
    moechten, ist GeheimChaos genau richtig."

Details:
 
   1) Multiple SQL Injection Vulnerabilities in gc.php
      
      ...
      
      arround lines 78-79
      
      $tmpQuery = mysql_query("SELECT * FROM $cfgTabelleUserDaten
WHERE username = '$Temp_entered_login'") or die("INSERT ERROR 2");
      mysql_query("DELETE FROM $cfgTabelleOnline WHERE username =
'$Temp_entered_login'") or die("DELETE Error 3");

Here attackers can use $Temp_entered_login

...

arround line 103

$tmpQuery = mysql_query("SELECT * FROM $cfgTabelleUserDaten
WHERE email = '$Temp_entered_email'") or die("INSERT ERROR 451");

...

arround line 133

$tmpQuery = mysql_query("SELECT * FROM $cfgTabelleUserDaten
WHERE username = '$Temp_entered_login'") or die("INSERT ERROR 2");

This line can be usefull if you want to perform a login bypass ...

...

2) Multiple SQL Injection Vulnerabilities in registieren.php

...

arround line 50

mysql_query("UPDATE $cfgTabelleUserDaten SET email =
'$form_email', vorname = '$form_vorname', nachname = '$form_nachname',
      strasse = '$form_strasse', plzort = '$form_plzort', land =
'$form_land', homepage = '$form_homepage', status = '$usernochfrei',
      userpic = '$form_bildpfad', privzeigen = '$form_profilsichtbar',
sprache = '$Temp_sprache', geb_tag = '$form_tag',
      geb_monat = '$form_monat', geb_jahr = '$form_jahr', aktivstr =
'$Temp_akt_string', icq = '$form_icq', msn = '$form_msn',
      yahoo = '$form_yahoo', profcheck = '0' WHERE userid =
'$geheimchaos->ID'");

...

arround line 170
      
      $tmpQuery = mysql_query("INSERT INTO $cfgTabelleUserDaten
(username,password,email,vorname,nachname,strasse,plzort,land,homepage,
     
geb_tag,geb_monat,geb_jahr,status,aktivstr,passneu,regdatum,letzterbesuc
h,besuchanzahl,letzteip,userpic,fehlerhaft,profcheck,
      privzeigen,sprache,icq,msn,yahoo) VALUES
('$form_username','$Temp_form_pass','$form_email','$form_vorname','$form
_nachname',
     
'$form_strasse','$form_plzort','$form_land','$form_homepage','$form_tag'
,'$form_monat','$form_jahr','0','$Temp_akt_string','',
     
'$timestamp','$timestamp','0','$Temp_ip','$form_bildpfad','0','0','$form
_profilsichtbar','$Temp_sprache','$form_icq','$form_msn',
      '$form_yahoo')") or die("INSERT ERROR 99");
      
      ...

Here the most variables are not checked by the script.

Note:

There are much more sql injection vulnerabilities and possible
cross site scripting vulnerabilities in this script.

Version note:

The "NewsletterChaos" and "ForumChaos" script based on this script.

Solution:

Take a view on PHP's htmlentities and mysql_real_escape_string
functions and try to research the code by your own.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (MingW32)
 
iD8DBQFE0oOwqBhP+Twks7oRAtjPAJ9hTR7LYl0TJw2KWlsGuGpkK5aYDQCfTsDL
KK8DlnOh/Mcm+Apzgz9jE9U=
=5Ilf
-----END PGP SIGNATURE-----
|参考资料

来源:XF
名称:geheimchaos-gc-registieren-sql-injection(28221)
链接:http://xforce.iss.net/xforce/xfdb/28221
来源:BID
名称:19342
链接:http://www.securityfocus.com/bid/19342
来源:BUGTRAQ
名称:20060803GeheimChaos<=0.5MultipleSQLInjectionVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/442209/100/100/threaded
来源:VUPEN
名称:ADV-2006-3154
链接:http://www.frsirt.com/english/advisories/2006/3154
来源:SECUNIA
名称:21355
链接:http://secunia.com/advisories/21355
来源:FULLDISC
名称:20060803GeheimChaos<=0.5MultipleSQLInjection
链接:http://marc.theaimsgroup.com/?l=full-disclosure&m=115464299914573&w=2
来源:SREASON
名称:1376
链接:http://securityreason.com/securityalert/1376