1:14 PM Digital Scribe 1.4.1 Multiple SQL Injection Vulnerabilities | |
| Digital Scribe 1.4.1 Multiple SQL Injection Vulnerabilities Name Digital Scribe Vendor http://www.digital-scribe.org Versions Affected 1.4.1 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date 2009-12-11 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX VI. DISCLOSURE TIMELINE I. ABOUT THE APPLICATION The Digital Scribe is a free, intuitive system designed to help teachers put student work and homework assignments online. II. DESCRIPTION This application is affected by many SQL Injection security flaws. In order to exploit they, the Magic Quotes GPG (php.ini) must be Off except one. I tested 1.4.1 version only, however other versions may be also vulnerable. III. ANALYSIS Summary: A) Multiple SQL Injection A) Multiple SQL Injection Multiple SQL Injection issues has been found in Digital Scribe version 1.4.1 and no authentication is required in order to exploit these vulnerabilities. The most issues required the Magic Quotes GPG setted to off except one (stuworkdisplay.php). For semplicity I reported only this last one vulnerable code. Vulnerable code: ........ $show = mysql_query("SELECT * FROM ".$conf['tbl']['projecttable'] WHERE(ID=$HTTP_GET_VARS[ID])") ........ IV. SAMPLE CODE http://site/path/ version(),user(),3,4,5,6,7,8, V. FIX $id = intval($_GET['ID']); $show = mysql_query("SELECT * FROM ".$conf['tbl']['projecttable'] WHERE(ID=$id)"); VIII. DISCLOSURE TIMELINE 2009-12-11 Bug discovered 2009-12-11 Initial vendor contact 2009-12-11 Advisory Release | |
|
| |
| Total comments: 0 | |
