lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 26 Aug 2010 21:28:09 +0200
From: Mark van Tilburg <markvantilburg@...il.com>
To: bugtraq@...urityfocus.com
Subject: BugTracker.net 3.4.3 SQL Injection

BugTracker.net 3.4.3 SQL Injection

 Name              BugTracker.NET
 Vendor            http://www.ifdefined.com/www/
 Versions Affected < 3.4.4 (when custom fields are used)

 Author            Mark van Tilburg
 Website           http://markvt.info
 Contact           markvantilburg [at] gmail [dot] com
 Date              2010-08-22

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 VI.   Dates


I. ABOUT THE APPLICATION
________________________

A web-based bug or issue tracker written using ASP.NET,
 C#, and SQL Server (SQL Server Express too).
Probably has all the features you need. Easy to setup.
 Power and flexibility when you need it. Learn more at
http://ifdefined.com/bugtrackernet.html


II. DESCRIPTION
_______________

A parameter is not properly sanitised before being
used in SQL queries.

If no custom fields are used this vulnerability
cannot be misused.


III. ANALYSIS
_____________

Summary:

A) SQL Injection
_______________________________

The application allows the use of Custom Fields, searching
of these custom fields is possible on the search page.
The value used for searching the custom field is not
properly cleaned before being used in the SQL query.

Please note this vulnerability is in the code lot for a long time
if using BugTracker.NET publicly you could be vulnerable.

IV. SAMPLE CODE
_______________

Use ' in the search box of a custom field

V. FIX
______

A) Don't use custom fields

B) Upgrade to v3.4.4 (http://sourceforge.net/projects/btnet/files/)

C) Or do the fix manually by following the steps at:
http://btnet.svn.sourceforge.net/viewvc/btnet/www/search.aspx?r1=559&r2=566

VI. DATES
______
Reported to author: 2010-08-20
Acknowledge by author: 2010-08-20
Fixed by author: 2010-08-22

Powered by blists - more mailing lists