full-disclosure - Re: MODX SQLi from oss-sec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOJKFBCac9x46FHAZi5EsGXwr0C802YQo8h1tzrdwedPQ4oEjQ@mail.gmail.com>
Date: Sat, 8 Mar 2014 11:24:58 -0600
From: Brandon Perry <bperry.volatile@...il.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: MODX SQLi from oss-sec

Sorry, oss-sec link:
http://seclists.org/oss-sec/2014/q1/532


On Sat, Mar 8, 2014 at 11:24 AM, Brandon Perry <bperry.volatile@...il.com>wrote:

> The author of the email to the oss-sec says he isn't sure if the linked
> commit fixes the issue and it should.
>
> You can exploit this possibly using a blind time or boolean sqli. This is
> me just playing around after doing some code analysis. Possibly other
> connectors are affected? No idea about whether authentication will be
> needed for all vectors, but in my cursory testing it needed at least a
> PHPSESSID cookie (maybe just get first index to get anon PHPSESSID, who
> knows).
>
> [2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Error 42000
> executing statement:
> Array
> (
>     [0] => 42000
>     [1] => 1064
>     [2] => You have an error in your SQL syntax; check the manual that
> corresponds to your MySQL server version for the right syntax to use near
> '1=1' at line 1
> )
>
> [2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Could not
> prepare context: mgr 1=1
> [2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
> executing statement:
> Array
> (
>     [0] => 42S22
>     [1] => 1054
>     [2] => Unknown column 'mgr' in 'where clause'
> )
>
> [2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Could not
> prepare context: mgr and 1=1
> [2014-03-08 11:03:54] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
> executing statement:
> Array
> (
>     [0] => 42S22
>     [1] => 1054
>     [2] => Unknown column 'mgr' in 'where clause'
> )
>
>
>
> --
> http://volatile-minds.blogspot.com -- blog
> http://www.volatileminds.net -- website
>



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/