bugtraq - PhpList Sql Injection and Path Disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050728000105.14455.qmail@securityfocus.com>
Date: 28 Jul 2005 00:01:05 -0000
From: thegreatone2176@...oo.com
To: bugtraq@...urityfocus.com
Subject: PhpList Sql Injection and Path Disclosure


-----------------------------------------
PhpList Sql Injection and Path Disclosure
-----------------------------------------

Vulnerabilities
---------------

1) There is an sql injection in the id parameter of public_html/lists/admin/?page=admin&id=INJECT HERE

2) Because of the heavy use of classes without proper checking of whether the script is directly called there is many path disclosures. The following pages are all affected under the preceding directory.

public_html/lists/admin:
about.php
connect.php
domainstats.php
usercheck.php

admin/commonlib/pages:
attributes.php
dbcheck.php
importcsv.php
user.php
usermgt.php
users.php

public_html/lists/admin/plugins:
helloworld.php
sidebar.php

public_html/lists/admin/plugsins/defaultplugin:
main.php

Solution
--------

1) cleanse the id parameter before processing

2) check to see if the script is being directly called and then have the script die

Credit
------

thegreatone2176@...oo.com