MkPortal - Multiple SQL Injection Vulnerabilities

We tried very hard to find wslabis mkportal SQL Injection but after ten
minutes of "research" we decided that it is hopeless to find exactly
the same bug and therefore we release a compilation of
mkportal sql injections for the interested reader.
Some of them are junk because you need a moderator acc but
the rest is exploitable by a normal user.
Some of the bugs can lead to user defined file deletions and command-exec bugs.

Sorry wslabi but 500$ for a bug in
this script is just a bad joke…

File: /modules/urlobox/index.php

1 . function delete_urlo()
$id = $mkportals->input['idurlo'];
$DB->query("DELETE FROM mkp_urlobox WHERE id = $id");

File: /modules/reviews/index.php

1. function update_file()
   $iden= $mkportals->input['iden'];
   $query = $DB->query("SELECT idauth FROM mkp_reviews WHERE id = $iden");

2. function del_file()
   $iden= $mkportals->input['iden'];
   $query = $DB->query( "SELECT image, author,
   idauth FROM mkp_reviews WHERE id = $iden");

File: /modules/news/index.php

1. function delete_news()
   $idnews = $mkportals->input['idnews'];
   $DB->query("DELETE FROM mkp_news WHERE id = $idnews");

2. function del_comment()
   $idcomm= $mkportals->input['idcomm'];
   $DB->query("DELETE FROM mkp_news_comments
   WHERE id = $idcomm");

File: /modules/gallery/index.php

1. function delete_comments()
   $idcomm= $mkportals->input['idcomm'];
   $DB->query("DELETE FROM mkp_gallery_comments
   WHERE id = $idcomm");

2. function edit_file()
   $iden = $mkportals->input['iden'];
   $query = $DB->query( "SELECT evento, titolo, descrizione,
   autore, idauth FROM mkp_gallery WHERE id = $iden");

3. function update_file()
   $iden= $mkportals->input['iden'];
   $query = $DB->query("SELECT idauth FROM mkp_gallery
   WHERE id = $iden");

4. function del_file()
   $iden= $mkportals->input['iden'];
   $query = $DB->query( "SELECT file, autore, idauth
   FROM mkp_gallery WHERE id = $iden");

5. function slide_update() {
   $ide= $mkportals->input['ide'];
   $cat = $mkportals->input['cat'];
   $query = $DB->query( "SELECT id, titolo, file FROM mkp_gallery WHERE id > $ide
   AND evento = $cat AND validate = '1' ORDER BY 'id' LIMIT 1");

File: /modules/downloads/index.php

1. function update_file()
   $iden= $mkportals->input['iden'];
   $query = $DB->query( "SELECT file, data, idauth, peso
   FROM mkp_download WHERE id = $iden");

2. function del_file()
   $iden= $mkportals->input['iden'];
   $query = $DB->query( "SELECT file, autore, idauth
   FROM mkp_download WHERE id = $iden");

…

Just look for del_, edit_ or update functions and you will find more.

greetings to jmp-esp
jmp-esp.kicks-ass.net

IRC: jmp-esp.kicks-ass.net / 6667 or 6661 (ssl) #main