full-disclosure - The Everything Development System

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 01 Feb 2008 16:56:38 -0500
From: sub <sub@...m641a.net>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>, 
	Bugtraq <bugtraq@...urityfocus.com>
Subject: The Everything Development System - SQL Injection

Application:    The Everything Development System
Version(s):     <= Pre-1.0 (current version at time of release)
Author:         sub < sub@...m641a.net >
Released:       2/1/2008

There exists a vulnerability in The Everything Development Engine that
allows a user to inject their own SQL to modify a SELECT query, leading
to information disclosure, XSS, or privilege escalation. What's more,
passwords are stored in the database as plaintext, making user accounts
very easily compromised.

In some versions of the software I have encountered, the following proof
of concept will display a corresponding username and password in the
"core" field and "reputation" field on the page,  respectively.

Proof of Concept:
http://path.to/cms/index.pl?node_id=0/**/UNION/**/SELECT/**/null,101,null,1,null,null,passwd,null,null,nick,null/**/FROM/**/user/**/WHERE/**/nick/**/!%3d/**/''/**/%23

In other, probably more recent versions, a 13-column query is required
or the UNION. What does not change, is that of all of the various
versions I've encountered, all are vulnerable to SQL injection.

The ideal fix would be to ensure that the 'node_id' request variable is
the appropriate data-type (signed int) before passing it as part of a
SQL query.

Vendor Status:
A private ticket was created on the vendors Bug Tracker page prior to
this release. However, I have decided to release this vulnerability
without a reply from the vendor as the Bug Tracker, and development
project, seemed to be 'abandonded.'

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/