Digital Scribe 1.4.1 Multiple SQL Injection Vulnerabilities

vendor:

Digital Scribe

by:

Salvatore Fresta aka Drosophila

7.5

CVSS

HIGH

Multiple SQL Injection

CWE

Product Name: Digital Scribe

Affected Version From: 1.4.2001

Affected Version To: 1.4.2001

Patch Exists: YES

Related CWE: N/A

CPE: a:digital-scribe:digital_scribe

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Digital Scribe 1.4.1 Multiple SQL Injection Vulnerabilities

Digital Scribe version 1.4.1 is vulnerable to multiple SQL Injection security flaws. In order to exploit them, the Magic Quotes GPG (php.ini) must be Off except one. An attacker can exploit this vulnerability by sending a malicious HTTP GET request to the vulnerable page. For example, http://site/path/stuworkdisplay.php?ID=-1) UNION ALL SELECT version(),user(),3,4,5,6,7,8,9,10,11%23

Mitigation:

The application should use prepared statements and parameterized queries to prevent SQL injection attacks. The application should also validate user input and filter out any malicious input.

Source

Exploit-DB raw data:

Digital Scribe 1.4.1 Multiple SQL Injection Vulnerabilities

 Name              Digital Scribe
 Vendor            http://www.digital-scribe.org
 Versions Affected 1.4.1

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2009-12-11

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 VI.   DISCLOSURE TIMELINE


I. ABOUT THE APPLICATION

The Digital Scribe is a free, intuitive system designed to
help teachers put  student work  and homework  assignments
online.


II. DESCRIPTION

This  application  is  affected   by  many  SQL  Injection
security flaws. In order to exploit they, the Magic Quotes
GPG (php.ini) must  be  Off  except one.
I tested 1.4.1 version only, however other versions may be
also vulnerable.


III. ANALYSIS

Summary:

 A) Multiple SQL Injection

A) Multiple SQL Injection

Multiple SQL Injection issues  has been found  in  Digital
Scribe version 1.4.1  and  no authentication  is  required
in order to exploit these vulnerabilities.
The most  issues  required  the Magic Quotes GPG setted to
off except one (stuworkdisplay.php).
For semplicity  I reported only  this  last one vulnerable
code.

Vulnerable code:

........

 $show = mysql_query("SELECT * FROM ".$conf['tbl']['projecttable']."
WHERE(ID=$HTTP_GET_VARS[ID])");

........


IV. SAMPLE CODE

http://site/path/stuworkdisplay.php?ID=-1) UNION ALL SELECT
version(),user(),3,4,5,6,7,8,9,10,11%23


V. FIX

$id = intval($_GET['ID']);
$show = mysql_query("SELECT * FROM ".$conf['tbl']['projecttable']."
WHERE(ID=$id)");


VIII. DISCLOSURE TIMELINE

2009-12-11 Bug discovered
2009-12-11 Initial vendor contact
2009-12-11 Advisory Release