bugtraq - Timesheet 1.2.1 Blind SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060905195610.9941.qmail@securityfocus.com>
Date: 5 Sep 2006 19:56:10 -0000
From: secaware2006@...oo.com
To: bugtraq@...urityfocus.com
Subject: Timesheet 1.2.1 Blind SQL Injection Vulnerability

About:

Timesheet.php is a PHP application designed to keep track of the hours worked by multiple people on multiple projects. It allows users to log in through their web browser and manage the times that they are clocked on or clocked off.

Description:

A vulnerability can be found on the file login.php on $_POST['username'] variable. When magic_quotes_gpc is set to Off an intruder can trigger a blind sql injection.

Escalation:

1. Disclosure of administrator username and password hash (MD5, PASSWORD) credentials.
2. Remote code execution in case the intruder knows where to save the output of the sql injection on the local path.

Solution:

Create addslashes function that will filter the $_POST and $_GET variables.

Vendor:

http://sourceforge.net/projects/tsheet
dwayner79 at users.sourceforge.net
vexil at users.sourceforge.net

Time table:

Notified: 09/04/2006
Response: No Response
Public disclosure: 09/05/2006
Updates: N/A

Credits:

Research By: Secaware Research
Research Site: http://secaware.blogspot.com
Research Mail: secaware2006 at yahoo dot com

References:

http://secaware.blogspot.com/2006/09/timesheet-121-blind-sql-injection.html