glFusion 'SESS_updateSessionTime()' SQL Injection Vulnerability

Bugtraq ID:	34361
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 03 2009 12:00AM
Updated:	Apr 09 2009 10:06PM
Credit:	Nine:Situations:Group::bookoo
Vulnerable:	glFusion glFusion 1.1.2 glFusion glFusion 1.1.1 glFusion glFusion 1.1 Geeklog Geeklog 1.5.2 Geeklog Geeklog 1.5.1 Geeklog Geeklog 1.5 Geeklog Geeklog 1.4.1 Geeklog Geeklog 1.4 sr1 Geeklog Geeklog 1.3.11 sr4 Geeklog Geeklog 1.3.11 sr3 Geeklog Geeklog 1.3.11 sr1 Geeklog Geeklog 1.3.11 rc1 Geeklog Geeklog 1.3.11 Geeklog Geeklog 1.3.10 Geeklog Geeklog 1.3.9 sr3 Geeklog Geeklog 1.3.9 sr2 Geeklog Geeklog 1.3.9 sr1 Geeklog Geeklog 1.3.9 Geeklog Geeklog 1.3.8 rc2 Geeklog Geeklog 1.3.8 rc1 Geeklog Geeklog 1.3.8 -1sr2 Geeklog Geeklog 1.3.8 -1sr1 Geeklog Geeklog 1.3.8 -1 Geeklog Geeklog 1.3.8 Geeklog Geeklog 1.3.7 sr2 Geeklog Geeklog 1.3.7 sr1 Geeklog Geeklog 1.3.7 Geeklog Geeklog 1.3.5 sr2 Geeklog Geeklog 1.3.5 sr1 Geeklog Geeklog 1.3.5 Geeklog Geeklog 1.3 - Apache Software Foundation Apache 1.3.22 - Apache Software Foundation Apache 1.3.20 - Apache Software Foundation Apache 1.3.20 - Apache Software Foundation Apache 1.3.19 - Apache Software Foundation Apache 1.3.19 - Apache Software Foundation Apache 1.3.18 - Apache Software Foundation Apache 1.3.18 - Apache Software Foundation Apache 1.3.17 - Apache Software Foundation Apache 1.3.17 Geeklog Geeklog 1.4.0sr4 Geeklog Geeklog 1.4.0sr4 Geeklog Geeklog 1.4.0sr3 Geeklog Geeklog 1.4.0sr2 Geeklog Geeklog 1.3.9sr5 Geeklog Geeklog 1.3.11sr5
Not Vulnerable:	glFusion glFusion 1.1.3 Geeklog Geeklog 1.5.2 sr2

glFusion 'SESS_updateSessionTime()' SQL Injection Vulnerability

glFusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects glFusion 1.1.2 and earlier. Note that it also affects Geeklog 1.5.2 and earlier.

glFusion 'SESS_updateSessionTime()' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following exploit is available:

• /data/vulnerabilities/exploits/34361.php

glFusion 'SESS_updateSessionTime()' SQL Injection Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.


glFusion glFusion 1.1

• glFusion glFusion CMS v1.1.3
  http://www.glfusion.org/filemgmt/visit.php?lid=275

glFusion glFusion 1.1.1

• glFusion glFusion CMS v1.1.3
  http://www.glfusion.org/filemgmt/visit.php?lid=275

glFusion glFusion 1.1.2

• glFusion glFusion CMS v1.1.3
  http://www.glfusion.org/filemgmt/visit.php?lid=275

Geeklog Geeklog 1.4.1

• Geeklog geeklog-1.4.x-patch.tar.gz
  http://www.geeklog.net/filemgmt/index.php?id=951

Geeklog Geeklog 1.5

• Geeklog geeklog-1.5.2sr1-upgrade.tar.gz
  http://www.geeklog.net/filemgmt/index.php?id=950

Geeklog Geeklog 1.5.1

• Geeklog geeklog-1.5.2sr1-upgrade.tar.gz
  http://www.geeklog.net/filemgmt/index.php?id=950

Geeklog Geeklog 1.5.2

• Geeklog geeklog-1.5.2sr1-upgrade.tar.gz
  http://www.geeklog.net/filemgmt/index.php?id=950

glFusion 'SESS_updateSessionTime()' SQL Injection Vulnerability

References:

• Geeklog 1.5.2sr2 (Geeklog)
  
• glFusion Homepage (glFusion)
  
• glFusion v1.1.3 Released (glFusion)
  
• glFusion <= 1.1.2 COM_applyFilter()/cookies remote blind sql ([email protected])
  
• Geeklog <=1.5.2 'SESS_updateSessionTime()' vulnerability ([email protected])