bugtraq - Re: SQL Injection in phpMySport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1104260046450.21990@forced.attrition.org>
Date: Tue, 26 Apr 2011 00:58:28 -0500 (CDT)
From: security curmudgeon <jericho@...rition.org>
To: advisory@...ridge.ch
Cc: bugtraq@...urityfocus.com
Subject: Re: SQL Injection in phpMySport

: Vulnerability ID: HTB22770
: Reference: http://www.htbridge.ch/advisory/sql_injection_in_phpmysport.html

: Vulnerability Details:

: The vulnerability exists due to failure in the "/index.php" script to 
: properly sanitize user-supplied input in "v1" variable. Attacker can 
: alter queries to the application SQL database, execute arbitrary queries 
: to the database, compromise the application, access or modify sensitive 
: data, or exploit various vulnerabilities in the underlying SQL database.
: 
: http://[host]/index.php?r=news&v1=123%27%20union%20select%201,2,3,4,5,6,@@version,8,9,10,11,12,13,14,15,16,17%20--%201

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-1109

Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, 
when magic_quotes_gpc is disabled, allow remote attackers to execute 
arbitrary SQL commands via the [..] (2) v1 parameter in a news action, 
[..]

1. You kids can't seem to search a VDB before posting. This was disclosed 
2009-03-12 and assigned CVE-2010-1109.

2. As usual, you leave of important technical details such as the 
requirement of magic_quotes_gpc to be disabled.

3. Predictably, other advisories fall under this. Splitting 
advisories out like this doesn't fool anyone you know.. 

http://www.htbridge.ch/advisory/sql_injection_in_phpmysport_1.html
http://www.htbridge.ch/advisory/sql_injection_in_phpmysport_2.html

Both of these are also covered under CVE-2010-1109.