Canteen Joomla Component 1.0 Multiple Remote Vulnerabilities

 Name              Canteen
 Vendor            http://www.miniwork.eu
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-04-07

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION

Canteen is a Joomla 1.5 component.
This component is written for canteens.  You  can  easily 
manage daily menu with this component.


II. DESCRIPTION

Some parameters are not sanitised  before  being  used in
SQL queries and in danger PHP's functions.


III. ANALYSIS

Summary:

 A) Local File Inclusion
 B) Multiple Blind SQL Injection
 

A) Local File Inclusion

The controller parameter in canteen.php is not  sanitised
before  being  used in the PHP function's require_once().
This allows a guest to include local files. The following
is the affected code:

if($controller = JRequest::getVar('controller')) {
	require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');
}


B) Multiple Blind SQL Injection

The  meailid  parameter  in   menu.php  is  not  properly
before being used in multiple SQL queries.  This  can  be
exploited  to  manipulate  SQL   queries   by   injecting
arbitrary SQL code. The following is the affected code:


$mealid	= JRequest::getVar('mealid');
$SQLQuery = "INSERT INTO #__miniwork_canteen_order  (jo_userid, jo_mealid, jo_created, jo_createdby, jo_changed, jo_changedby)
            VALUES  (".$user->id.", ".$mealid.", NOW(), '".$user->sSecondName." ".$user->sFirstName."', NOW(), '".$user->sSecondName." ".$user->sFirstName."')";
                         
                         
$mealid	= JRequest::getVar('mealid');
$SQLQuery = "DELETE FROM #__miniwork_canteen_order WHERE jo_mealid = ".$mealid." AND jo_userid = ".$orduser->id.";";


$mealid	= JRequest::getVar('mealid');
$SQLQuery = "UPDATE #__miniwork_canteen_order SET jo_userid = ".$orduser->id.", jo_changed=NOW(), jo_changedby='".$orduser->sSecondName." ".$orduser->sFirstName."' WHERE jo_mealid=".$mealid." AND jo_userid is null LIMIT 1;";                         


IV. SAMPLE CODE

A) Local File Inclusion

http://site/path/index.php?option=com_canteen&controller=../../../../../etc/passwd%00 


V. FIX

Checking  for  path traversal sequence and useing of  PHP
function's intval() for integer values.