bugtraq - Re: Another SQL injection in ProFTPd with mod

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4992F7CD.8040606@redpill-linpro.com>
Date: Wed, 11 Feb 2009 17:07:41 +0100
From: Edward Bjarte Fjellskål <edward.fjellskal@...pill-linpro.com>
To: gat3way@...3way.eu
Cc: bugtraq@...urityfocus.com
Subject: Re: Another SQL injection in ProFTPd with  mod_mysql (probably postgres
 as well)

gat3way@...3way.eu wrote:
> Hello,
> 
> Just found out a problem with proftpd's sql authentication. The problem is easily reproducible if you login with username like:
> 
> USER %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; -- 
> 
> and a password of "1" (without quotes).
> 
> which leads to a successful login. Different account logins can be made successful using the limit clase (e.g appending "LIMIT 5,1" will make you login with as the 5th account in the users table).
> 
> As far as I can see in the mysql logs the query becomes:
> 
> SELECT userid, passwd, uid, gid, homedir, shell FROM users WHERE (userid='{UNKNOWN TAG}') and 1=2 union select 1,1,uid,gid,homedir,shell from users limit 1,1; -- ') LIMIT 1
> 
> I think the problem lies in the handling of the "%" character (probably that's some way to sanitize input to avoid format string things?).
> 
> Anyway, %' effectively makes the single quote unescaped and that eventually allows for an SQL injection during login.

Tested also on Debian Etch ProFTPD 1.3.0

Does not work.

E