+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Possible vulnerability found. Need help for continuation (/Thread-Possible-vulnerability-found-Need-help-for-continuation)
Possible vulnerability found. Need help for continuation - yesthereis - 10-21-2016
Hi,
I have been playing around with a website looking for places they messed up. I don't have any goals and really do not want to break anything.
I was already able to find some vulnerabilities, but they all involved getting data from the client machine visiting the site and not the server.
Since I don't intend to do anything too harmful and just want to see what small things I could play around with this is pretty uninteresting to me.
After trying around a bit more I may have found a database vulnerability that may allow me to mess around with the server a bit.
However, I am not at all familiar with php and only slightly familiar with SQL language. This is no problem for me because the fun for me lies in figuring these things out as I go.
However, since I really have absolutely no clue right now I could really use some help.
Getting to the point:
The site frequently sends their users emails. The user can decide to subscribe or unsubscribe from emails with certain content. This is done over a form that for each category passes on either a "0" or a "1".
I found that if I send the post value 0+0, 1+0, or 0+1 it will actually do the calculation and change the setting accordingly. From my understanding, this shouldn't happen with properly sanitized user input.
Question is: Am I just terribly wrong and there is absolutely nothing off? Or does this mean that somebody just assumed since the form consists of radio buttons that they don't need to handle the input with care?
If there is actually something that can be done with this, what would be the next step? Since this doesn't actually display any results to me the way a GET request would, and I cannot save any value but 0 and 1 in the database (I assume the data is boolean) I am unsure how to continue.
If my question(s) is/are completely stupid please let me know. But also let me know in a way allowing me to learn from my mistake and avoid it in the future.
RE: Possible vulnerability found. Need help for continuation - DSVR - 10-23-2016
What you're saying there, all results in true values that fit with the function. The binary 0 or 1 which is, subscribe or unsubscribe. So that's the desired function. What you want to do, is pass invalid arguments to the form and see how it responds.
RE: Possible vulnerability found. Need help for continuation - yesthereis - 10-24-2016
I am aware that my "calculations" result in the only two valid values.
The question I mainly have is, if you have an URL in the form of web.net?p=15+1 and it shows you the same page it would output for web.net?p=16 is this a sign of some vulnerability?
As for the question what it does when I try to pass any other value (for example 6) it will output: {"msg":"Subscriptions updated.","color":"green"}An error occured [Single Digit Number, dependent on which of the settings I tried to pass an invalid value for]
I assume this is just a programming error on the php script.
RE: Possible vulnerability found. Need help for continuation - Bish0pQ - 10-24-2016
Well in theory, you could exploit any flaw. There are a lot of SQLi vulnerability scanners, have you tried running something like SQLmap on that page? Not saying that it will automatically exploit it, but it might give some extra information or something.
RE: Possible vulnerability found. Need help for continuation - whatarethechances - 11-02-2016
Maybe adding some regular expressions can prevent SQL injections.
RE: Possible vulnerability found. Need help for continuation - auspexpt - 11-08-2016
For SQLi I usually try the subtraction to confirm the vulnerabilities.
So in your case, try for example 2-1 or even 6-5, if it has the same behaviour than just 1 and let's stay 2-2 has the same behaviour as 0, then it's vulnerable.
Might not be exploitable though. But Sqlmap should be able to find the vulnerability and exploit it. You might have to supply the --string for it to differentiate the 2 cases.