Tutorials Manager Multiple Remote SQL Injection Vulnerabilities
BID:10314
Info
Tutorials Manager Multiple Remote SQL Injection Vulnerabilities
| Bugtraq ID: | 10314 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 10 2004 12:00AM |
| Updated: | May 10 2004 12:00AM |
| Credit: | Disclosure of this issue is credited to Hillel Himovich <[email protected]>. |
| Vulnerable: |
Tutorials Manager Web Application 1.0 beta 2 |
| Not Vulnerable: | |
Discussion
Tutorials Manager Multiple Remote SQL Injection Vulnerabilities
Reportedly Tutorials Manager is affected by multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input.
These SQL injection issues might allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
Reportedly Tutorials Manager is affected by multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input.
These SQL injection issues might allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
Exploit / POC
Tutorials Manager Multiple Remote SQL Injection Vulnerabilities
No exploit is required to leverage these issues. The following proof of concept has been provided:
http://www.example.com/guides/index.php?lang=0&CODE=02&id=1[SQL]
http://www.example.com/guides/index.php?lang=0&CODE=01&id=1[SQL]
http://www.example.com/guides/index.php?lang=0&CODE=14&id=1[SQL]
http://www.example.com/guides/admin.php?s=[SOMETHING]&act=own
http://www.example.com/sites/guides/admin.php?s=[SOMETHING]&act=admin&CODE=01
Passing the input ' OR 1=1 /* through the 'username' filed of the 'admin.php' script is reported to grant unauthorized administrator access to the affected application.
No exploit is required to leverage these issues. The following proof of concept has been provided:
http://www.example.com/guides/index.php?lang=0&CODE=02&id=1[SQL]
http://www.example.com/guides/index.php?lang=0&CODE=01&id=1[SQL]
http://www.example.com/guides/index.php?lang=0&CODE=14&id=1[SQL]
http://www.example.com/guides/admin.php?s=[SOMETHING]&act=own
http://www.example.com/sites/guides/admin.php?s=[SOMETHING]&act=admin&CODE=01
Passing the input ' OR 1=1 /* through the 'username' filed of the 'admin.php' script is reported to grant unauthorized administrator access to the affected application.
Solution / Fix
Tutorials Manager Multiple Remote SQL Injection Vulnerabilities
Solution:
The vendor has released a patch dealing with this issue.
Tutorials Manager Web Application 1.0 beta 2
Solution:
The vendor has released a patch dealing with this issue.
Tutorials Manager Web Application 1.0 beta 2
-
Tutorials Manager b2_sec_update.zip
http://forums.phpcafe.net/b2_sec_update.zip
References
Tutorials Manager Multiple Remote SQL Injection Vulnerabilities
References:
References:
- Product Home Page (Tutorials Manager)
- Security update (Tutorials Manager)