bugtraq - Invision Power Top Site List SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040322092247.2305.qmail@search.securityfocus.com>
Date: 22 Mar 2004 09:22:47 -0000
From: JeiAr <security@...ftech.org>
To: bugtraq@...urityfocus.com
Subject: Invision Power Top Site List SQL Injection Vulnerability

Vendor  : Invision Power Services
URL     : http://www.invisiontsl.com
Version : Invision Power Top Site List v1.1 RC 2 && Earlier
Risk    : SQL Injection Vulnerability

Description:
Invision Power Top Site List is a flexible site ranking script 
written in PHP, the popular programming choice for web developers. 
Featuring an impressive feature set with a user-friendly interface 
your community will feel at home using the system. 

SQL Injection Vulnerability:
Invision Power Top Site List is prone to an SQL Injection vuln
in its "comment" feature. This issue is very much exploitable as
the injection happens right in the middle of a WHERE statement.
Lets have a look at an example error message to get a better idea
of what is going on.

-----[ Start Error ]---------------------------------------------

Error: Error executing query

The software returned the following error:

You have an error in your SQL syntax. Check the manual that 
corresponds to your MySQL server version for the right syntax 
to use near '[ Evil_Query ]' at line 1

Query Executed: SELECT * FROM tsl_sites WHERE id = [Evil_Query]

-----[ /Ends Error ]---------------------------------------------

As we can see from this it would be of little difficulty for any
attacker to execute arbitrary requests. For example pulling the
admin hash and/or possibly taking admin control over an affected
Invision Power Top Site List. Below is an example url to show how
the issue could be exploited.

index.php?act=comments&id=[Evil_Query]

Solution:
The Invision Power Services team were contacted immediately and
hopefully a fix will be available soon since this is an application
that cost users money to use. The original advisory can be found
at the following url @ http://www.gulftech.org/03212004.php

Credits:
Credits go to JeiAr of the GulfTech Security Research Team. 
http://www.gulftech.org