bugtraq - OrderSys <= 1.6.4 Sql Injection Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAPhqm0MC1gWTuaboKv-ir7JwULU12TGD3kXUJL1ZSdr2DdPmhQ@mail.gmail.com>
Date: Tue, 8 Nov 2011 19:31:10 +0100
From: muuratsalo experimental hack lab <muuratsalo@...il.com>
To: bugtraq <bugtraq@...urityfocus.com>
Subject: OrderSys <= 1.6.4 Sql Injection Vulnerabilities

Dear All,
I have found multiple sql injection vulnerabilities in OrderSys <= 1.6.4.
The vendor knows the vulnerabilities and he is fixing them as stated
in the enclosed advisory. (See also
http://www.bioinformatics.org/phplabware/labwiki/index.php?page=release_notes)
Since the developer is currently patching the current release it is
possible that you can find in the software link different versions of
the same app (1.6.4).
Best,
muuratsalo

------------------------------------------------------------------------
advisory ------------------------------------------------------------------------
------------------------------------------------------------------------
OrderSys <= 1.6.4 Sql Injection Vulnerabilities
------------------------------------------------------------------------

author............: muuratsalo (Revshell.com)
contact...........: muuratsalo[at]gmail[dot]com
download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php

[0x01] Vulnerability overview:

All versions of OrderSys <= 1.6.4 are affected by Sql injection vulnerabilities.
A valid account could be required to exploit the vulnerabilities.

[0x02] Disclosure timeline:

[04/11/2011] - Multiple sql injection vulnerabilities discovered and
reported to the vendor
[05/11/2011] - Multiple sql injection vulnerabilities fixed, OrderSys
1.6.4 released.
[05/11/2011] - OrderSys 1.6.4 is still vulnerable to some sql
injection vulnerabilities.
[05/11/2011] - The vendor is currently working on fixing the reported issues.
[06/11/2011] - Public disclosure

[0x03] Proof of Concept:

http://localhost/ordersys/ordering/interface_creator/index.php?table_name=vendor&function=search&where_clause=[SQL
INJECTION]&page=0&order=Address&order_type=ASC
http://localhost/ordersys/ordering/interface_creator/index_long.php?table_name=vendor&function=search&where_clause=[SQL
INJECTION]&page=0&order=Address&order_type=ASC
http://localhost/ordersys/ordering/interface_creator/index_short.php?table_name=vendor&function=search&where_clause=[SQL
INJECTION]&page=0&order=Address&order_type=ASC