bugtraq - SQL Injection in TestLink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 17 Feb 2016 16:17:42 +0100 (CET)
From: High-Tech Bridge Security Research <advisory@...ridge.ch>
To: bugtraq@...urityfocus.com
Subject: SQL Injection in TestLink

Advisory ID: HTB23288
Product: TestLink
Vendor: TestLink Development Team
Vulnerable Version(s): 1.9.14 and probably prior
Tested Version: 1.9.14
Advisory Publication:  January 7, 2016  [without technical details]
Vendor Notification: January 7, 2016 
Vendor Patch: January 9, 2016 
Public Disclosure: February 17, 2016 
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High 
CVSSv3 Base Score: 7.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered high-risk SQL injection vulnerability in TestLink Open Source Test Management. The vulnerability can be exploited to alter the present SQL query and gain access to potentially sensitive information or even to completely compromise the vulnerable web application.

The vulnerability is caused by insufficient filtration of "apikey" HTTP GET parameter, passed to "lnl.php" PHP script. A remote unauthenticated attacker can inject and execute arbitrary SQL commands in application's database.

A simple exploit code below will display version of used MySQL server:

http://[host]/lnl.php?apikey=1239999999%27%20OR%201=%28IF%28MID%28version%28%29,1,1%29%20LIKE%205,%201,0%29%29%20--%202

-----------------------------------------------------------------------------------------------

Solution:

Update to TestLink 1.9.15

More Information:
http://mantis.testlink.org/view.php?id=7402

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23288 - https://www.htbridge.com/advisory/HTB23288 - SQL Injection in TestLink
[2] TestLink - http://testlink.org/ - TestLink Open Source Test Management
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.