Anton Raharja PlaySMS Valid Function SQL Injection Vulnerability

Bugtraq ID:	10970
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 18 2004 12:00AM
Updated:	Aug 18 2004 12:00AM
Credit:	Discovery is credited to Noam Rathaus.
Vulnerable:	Anton Raharja PlaySMS 0.7 Anton Raharja PlaySMS 0.6
Not Vulnerable:	Anton Raharja PlaySMS 0.7.1

Anton Raharja PlaySMS Valid Function SQL Injection Vulnerability

An SQL injection vulnerability is identified in the application that may allow attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks. This vulnerability exists due to insufficient sanitization of user-supplied input.

Specifically, user-supplied data from cookies is used in SQL queries without sanitization. This may allow a remote user to inject arbitrary SQL queries into the underlying database used by the application.

This issue is reported to exist in PlaySMS versions 0.7 and prior.

Anton Raharja PlaySMS Valid Function SQL Injection Vulnerability

No exploit is required.

The following proof of concept is available:

• /data/vulnerabilities/exploits/playsms_sql.pl

Anton Raharja PlaySMS Valid Function SQL Injection Vulnerability

Solution:
The vendor has released PlaySMS version 0.7.1 to address this issue.


Anton Raharja PlaySMS 0.6

• Anton Raharja playsms-0.7.1.tar.gz
  http://prdownloads.sourceforge.net/playsms/playsms-0.7.1.tar.gz?downlo ad

Anton Raharja PlaySMS 0.7

• Anton Raharja playsms-0.7.1.tar.gz
  http://prdownloads.sourceforge.net/playsms/playsms-0.7.1.tar.gz?downlo ad

Anton Raharja PlaySMS Valid Function SQL Injection Vulnerability

References:

• PlaySMS (Anton Raharja)
  
• PlaySMS SQL Injection via Cookie (securiteam)
  
• PlaySMS: Release Notes (Anton Raharja)