MiniTwitter Security Bypass and SQL Injection Vulnerabilities
BID:34795
Info
MiniTwitter Security Bypass and SQL Injection Vulnerabilities
| Bugtraq ID: | 34795 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 01 2009 12:00AM |
| Updated: | May 01 2009 06:26PM |
| Credit: | YEnH4ckEr |
| Vulnerable: |
BioScripts MiniTwitter 0.2 Beta |
| Not Vulnerable: |
BioScripts MiniTwitter 0.3 |
Discussion
MiniTwitter Security Bypass and SQL Injection Vulnerabilities
MiniTwitter is prone to a security-bypass vulnerability and an SQL-injection issue.
Exploiting the security-bypass issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This may compromise the application and may aid in further attacks.
MiniTwitter 0.2 Beta is vulnerable; other versions may also be affected.
MiniTwitter is prone to a security-bypass vulnerability and an SQL-injection issue.
Exploiting the security-bypass issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This may compromise the application and may aid in further attacks.
MiniTwitter 0.2 Beta is vulnerable; other versions may also be affected.
Exploit / POC
MiniTwitter Security Bypass and SQL Injection Vulnerabilities
Attackers can exploit the issues via a browser.
The following example URI is available:
http://www.example.com/index.php?user=2%27+UNION+ALL+SELECT+2,concat(nick,0x3A3A3A,password)+FROM+mt_users+WHERE+id_usr=1/*
The following exploit code is available:
Attackers can exploit the issues via a browser.
The following example URI is available:
http://www.example.com/index.php?user=2%27+UNION+ALL+SELECT+2,concat(nick,0x3A3A3A,password)+FROM+mt_users+WHERE+id_usr=1/*
The following exploit code is available:
Solution / Fix
MiniTwitter Security Bypass and SQL Injection Vulnerabilities
Solution:
Reports indicate that MiniTwitter 0.3 addresses these issues. Symantec has not confirmed this. Please see the references for more information.
Solution:
Reports indicate that MiniTwitter 0.3 addresses these issues. Symantec has not confirmed this. Please see the references for more information.
References
MiniTwitter Security Bypass and SQL Injection Vulnerabilities
References:
References: