full-disclosure - POWER PHLOGGER v.2.2.5 (username) SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 3 Jul 2007 10:56:55 +0300
From: "Attila Gerendi" <darkz.gsa@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: POWER PHLOGGER v.2.2.5 (username) SQL Injection

 POWER PHLOGGER v.2.2.5 (username) SQL Injection

Author: Attila Gerendi (Darkz)
Date: June 25, 2007
Package: POWER PHLOGGER (http://www.phpee.com/)
Versions Affected: v.2.2.5 (Other versions may also be affected)
Severity: SQL Injection

Description:

Input passed to the "username" parameter in "login.php" isn't properly
sanitised before being used in
a SQL query. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code and
bypass login sequence.

This SQL injection is "blind" so the user can not produce variations in the
server input however using
BENCHMARK it still can be used to retrieve sensitive data from the database
and/or heavily load the server
and produce DDOS attack.

The vulnerable code piece is in "/include/get_userdata.php"

/* assign the user's values */
$sql = "SELECT * FROM ".PPHL_TBL_USERS." WHERE id='$id' OR username='$id'";
$res = mysql_query($sql);

the vulnerable parameter at this point is $id and it is set trough session
variable $username from login.php
without any sanitation.

Status:
The product web page say: "Active development of PowerPhlogger has been
stopped as of August 2006.
The announced successor Phlogger3 will not be released. Also, I am not able
to provide you with support for
any previous version.", so any user using this version should correct the
bug herself.

Solution:

modify
/* assign the user's values */
$sql = "SELECT * FROM ".PPHL_TBL_USERS." WHERE id='$id' OR username='$id'";
$res = mysql_query($sql);

to

/* assign the user's values */
$id = mysql_escape_string($id);
$sql = "SELECT * FROM ".PPHL_TBL_USERS." WHERE id='$id' OR username='$id'";
$res = mysql_query($sql);

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/