full-disclosure - MODX SQLi from oss-sec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOJKFBDPiXdtYGP9ogASRwCSfDwXq91bGeFYtpjCgvmj7rsZPg@mail.gmail.com>
Date: Sat, 8 Mar 2014 11:24:17 -0600
From: Brandon Perry <bperry.volatile@...il.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: MODX SQLi from oss-sec

The author of the email to the oss-sec says he isn't sure if the linked
commit fixes the issue and it should.

You can exploit this possibly using a blind time or boolean sqli. This is
me just playing around after doing some code analysis. Possibly other
connectors are affected? No idea about whether authentication will be
needed for all vectors, but in my cursory testing it needed at least a
PHPSESSID cookie (maybe just get first index to get anon PHPSESSID, who
knows).

[2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Error 42000
executing statement:
Array
(
    [0] => 42000
    [1] => 1064
    [2] => You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near
'1=1' at line 1
)

[2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Could not
prepare context: mgr 1=1
[2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
executing statement:
Array
(
    [0] => 42S22
    [1] => 1054
    [2] => Unknown column 'mgr' in 'where clause'
)

[2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Could not
prepare context: mgr and 1=1
[2014-03-08 11:03:54] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
executing statement:
Array
(
    [0] => 42S22
    [1] => 1054
    [2] => Unknown column 'mgr' in 'where clause'
)

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/