full-disclosure - Re: MODX SQLi from oss-sec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAOJKFBCk+p6i1EHCQ0x57g0vNi+6ao8ZRPvYtZ9bUo-iVr60Tg@mail.gmail.com>
Date: Sat, 8 Mar 2014 11:59:10 -0600
From: Brandon Perry <bperry.volatile@...il.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: MODX SQLi from oss-sec

FWIW I believe it is this line that is vulnerable in particular. I can't
prove this at the moment though:

core/model/modx/processors/resource/getnodes.class.php:134:
 "(SELECT COUNT(*) FROM {$this->modx->getTableName('modResource')} WHERE
context_key = modContext.{$this->modx->escape('key')} AND id IN
({$this->defaultRootId})) > 0",



On Sat, Mar 8, 2014 at 11:24 AM, Brandon Perry <bperry.volatile@...il.com>wrote:

> Sorry, oss-sec link:
> http://seclists.org/oss-sec/2014/q1/532
>
>
> On Sat, Mar 8, 2014 at 11:24 AM, Brandon Perry <bperry.volatile@...il.com>wrote:
>
>> The author of the email to the oss-sec says he isn't sure if the linked
>> commit fixes the issue and it should.
>>
>> You can exploit this possibly using a blind time or boolean sqli. This is
>> me just playing around after doing some code analysis. Possibly other
>> connectors are affected? No idea about whether authentication will be
>> needed for all vectors, but in my cursory testing it needed at least a
>> PHPSESSID cookie (maybe just get first index to get anon PHPSESSID, who
>> knows).
>>
>> [2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Error 42000
>> executing statement:
>> Array
>> (
>>     [0] => 42000
>>     [1] => 1064
>>     [2] => You have an error in your SQL syntax; check the manual that
>> corresponds to your MySQL server version for the right syntax to use near
>> '1=1' at line 1
>> )
>>
>> [2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Could not
>> prepare context: mgr 1=1
>> [2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
>> executing statement:
>> Array
>> (
>>     [0] => 42S22
>>     [1] => 1054
>>     [2] => Unknown column 'mgr' in 'where clause'
>> )
>>
>> [2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Could not
>> prepare context: mgr and 1=1
>> [2014-03-08 11:03:54] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
>> executing statement:
>> Array
>> (
>>     [0] => 42S22
>>     [1] => 1054
>>     [2] => Unknown column 'mgr' in 'where clause'
>> )
>>
>>
>>
>> --
>> http://volatile-minds.blogspot.com -- blog
>> http://www.volatileminds.net -- website
>>
>
>
>
> --
> http://volatile-minds.blogspot.com -- blog
> http://www.volatileminds.net -- website
>



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/