SPGPartenaires Multiple SQL Injection Vulnerabilities

Bugtraq ID:	6455
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 20 2002 12:00AM
Updated:	Dec 20 2002 12:00AM
Credit:	Discovery of this vulnerability is credited to "Frog Man" <[email protected]>.
Vulnerable:	SPGPartenaires SPGPartenaires 3.0.1
Not Vulnerable:

SPGPartenaires Multiple SQL Injection Vulnerabilities

Several vulnerabilities have been discovered in SPGPartenaires. The vulnerabilities are due to insufficient sanitization of the 'pass' and 'SPGP' variables used to construct SQL queries in various PHP scripts. By exploiting these issues it is possible to modify the logic of SQL queries through malformed query strings in requests for the vulnerable script.

By injecting SQL code into the 'pass' or 'SPGP' variable, it may be possible for an attacker to corrupt member information. It may also be possible for attackers to perform more advanced attacks on the underlying database.

SPGPartenaires Multiple SQL Injection Vulnerabilities

The following proof of concept has been supplied by Frog-m@n:

http://www.example.com/modif/ident.php?id=[MEMBERID]&pass='%20OR%20''='
http://www.example.com/modif/delete.php?SPGP=[ID]%7C%7C'%20OR%20''='

SPGPartenaires Multiple SQL Injection Vulnerabilities

Solution:
The vendor has confirmed this issue and advised users to use the patch supplied by phpsecure.

Patch:


SPGPartenaires SPGPartenaires 3.0.1

• phpsecure SPGpartenaires3.0.1.zip
  http://phpsecure.rootzmail.net/SPGpartenaires3.0.1.zip

SPGPartenaires Multiple SQL Injection Vulnerabilities

References:

• phpsecure Home Page (phpsecure)
  
• SPGpartenaires (PHP) ("Frog Man" )