BID:15088

PHPWebSite Search Module SQL Injection Vulnerability

Info

PHPWebSite Search Module SQL Injection Vulnerability

Bugtraq ID:	15088
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 12 2005 12:00AM
Updated:	Oct 12 2005 12:00AM
Credit:	x97Rang is credited with the discovery of this vulnerability.
Vulnerable:	phpWebsite phpWebsite 0.10.1 + Gentoo Linux phpWebsite phpWebsite 0.10 phpWebsite phpWebsite 0.9.3 -4 phpWebsite phpWebsite 0.9.3 -3 phpWebsite phpWebsite 0.9.3 -2 phpWebsite phpWebsite 0.9.3 -1 phpWebsite phpWebsite 0.9.3 phpWebsite phpWebsite 0.8.3 phpWebsite phpWebsite 0.8.2 phpWebsite phpWebsite 0.7.3

Not Vulnerable:	phpWebsite phpWebsite 0.10.2

Discussion

PHPWebSite Search Module SQL Injection Vulnerability

phpWebSite is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

The vendor has released the patch phpwebsite_security_patch_20051202.tgz addressing this issue.

This vulnerability was originally believed to be related to to BID 14172 (PHPWebSite Index.PHP Multiple SQL Injection Vulnerabilities) but is a seperate issue.

Exploit / POC

PHPWebSite Search Module SQL Injection Vulnerability

No exploit is required.

The following proof of concept URI are available:
http://www.example.com/index.php?module='+UNION+select+username,username+from+mod_users+where+user_id='1'/*
http://www.example.com/index.php?module='+UNION+select+username,password+from+mod_users+where+user_id='1'/*

x97Rang has supplied the following exploit:

/data/vulnerabilities/exploits/phpwebsite-sql-inj.pl

Solution / Fix

PHPWebSite Search Module SQL Injection Vulnerability

Solution:
The vendor has released a patch addressing this issue.

phpWebsite phpWebsite 0.10