bugtraq - SQL Injection in WeBid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 17 Feb 2016 16:20:04 +0100 (CET)
From: High-Tech Bridge Security Research <advisory@...ridge.ch>
To: bugtraq@...urityfocus.com
Subject: SQL Injection in WeBid

Advisory ID: HTB23292
Product: WeBid
Vendor: WeBid
Vulnerable Version(s): 1.1.2P2 and probably prior
Tested Version: 1.1.2P2
Advisory Publication:  January 22, 2016  [without technical details]
Vendor Notification: January 22, 2016 
Vendor Patch: February 4, 2016 
Public Disclosure: February 17, 2016 
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High 
CVSSv3 Base Score: 7.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered SQL Injection vulnerability in a poplar web auction software WeBid. The vulnerability can be exploited by remote non-authenticated attacker to alter present SQL query and execute arbitrary SQL commands in application's database. Successful exploitation of the vulnerability will allow attacker to read, modify and delete arbitrary records in the database of vulnerable web application and gain complete control over the website. 

The vulnerability exists due to insufficient filtration of '$_SESSION["id"]' session variable. The attacker can alter the original SQL query and execute arbitrary SQL commands in application’s database. 

A simple exploit below will modify the SQL query and display version of current MySQL server. The exploitation technique consists of two steps. At the first step we modify '$_SESSION["id"]' session variable and inject our exploit into it:

http://webid/friend.php?id=-1%20UNION%20SELECT%20version()%20--%202

The exploitation actually occurs, when crafted '$_SESSION["id"]' variable is used in "/feedback.php" script. After visiting the following page MySQL version will be displayed:

http://webid/feedback.php?wid=1&sid=1&ws=w

-----------------------------------------------------------------------------------------------

Solution:

Apply vendor's security patch for WeBid 1.1.2P2

More Information:
http://webidsupport.com/forums/index.php?threads/security-patch-for-1-1-2p2-and-older.9078/

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23292 - https://www.htbridge.com/advisory/HTB23292  - SQL Injection in WeBid
[2] WeBid - http://www.webidsupport.com/ - WeBid is the perfect way to get your auction site up and away
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.