##########################www.BugReport.ir########################################

AmnPardaz Security Research Team

Title: SphereCMS Blind SQL Injection Vulnerability

Vendor: http://sphere.xlentprojects.se/

Vulnerable Version: 1.1 alpha (Latest version till now)

Exploitation: Remote with browser

Fix: N/A

###################################################################################

####################

• Description:
  ####################

SphereCMS is a CMS which allow managing forum, archive posts, chat like
posts (named shoutbox), friend in the site and personal profile. It has
one theme, but a buty one.
It uses MySQL as its backend DBMS and is written in PHP language.

####################

• Vulnerability:
  ####################

±-> Blind SQL Injection
The archive page is vulnerable to SQL injection. The GET variable,
namely 'view',
is not sanitized correctly in the SQL query. This hole can be used
for extracting
admin password. For deatils see 'Exploits' section.

####################

• Exploits/PoCs:
  ####################

±-> Exploiting The (MySQL) Blind SQL Injection:
The GET variavle 'view' in archive madule can be used for hacking process.
Check URI 'example.com/archive.php?view='; SQL query can be placed
at ''.
The users password is stored in `xcms_members` table. For extracting
password of 'Admin'
we could use following SQL injection vector:
?view=17' AND EXISTS
(/%00/SELECT * FROM xcms_members
WHERE username='Admin'
AND substr(/%00/password,#,1)='@')
AND '1'='1
replacing # with 1, 2, 3, … and @ with different characters. The
result page will show
the archive post with id '17' on correct and show no archive post if
@ was wrong.
So the password can be extracted in O(length of encrypted pass)=O(1).

+++ Special Technique for Bypassing SphereCMS Security Check:
SphereCMS checks all of parameters including 'view' GET parameter
before doing any
process. In these checks, any parameter which has a pattern like
"(*)" will result
to "die ()". Also we can not check the password words without
parenthesizes (it is
required for substr function and there are no substitute solution).

    For bypassing this check, I consider MySQL and PHP together. The PHP  

functions will consider
all strings JUST untill first null character. Also MySQL support
comment syntax
like /* the comment / and before executing any SQL query, these
comments will be removed
from the query by MySQL.
Thus I place a null character within MySQL comment right after each
open parenthesis. So
when PHP search for parenthesises, it find nothing since it reaches
null and finish searching.
Also when query is going to be executed, the null character will be
removed within the comment
(see the '(/%00*/' in the above SQL injection vector).

####################

• Solution:
  ####################

The parameters must be sanitized using the context sensitive
sanitizing function provided
by MySQL (mysql_real_escape_string), instead of manual sanitizing
which is usually error prone.

####################

• Original Advisory:
  ####################

http://www.bugreport.ir/index_68.htm

####################

• Credit:
  ####################
  AmnPardaz Security Research & Penetration Testing Group
  Contact: admin[4t}bugreport{d0t]ir
  www.BugReport.ir
  www.AmnPardaz.com