TaskFreak 0.6.2 - SQL Injection

CVE-2010-1583

Vendor notified and product update released.
Details of this report are also available at
http://www.madirish.net/?article=456


Description of Vulnerability:
- ------------------------------

The Tirzen Framework (http://www.tirzen.net/tzn/) is a supporting API
developed by Tirzen (http://www.tirzen.com), an intranet and internet
solutions provider. The Tirzen Framework contains a SQL injection
vulnerability (http://www.owasp.org/index.php/SQL_Injection). This
vulnerability could allow an attacker to arbitrarily manipulate SQL strings
constructed using the library. This vulnerability manifests itself most
notably in the Task Freak (http://www.taskfreak.com/) open source task
management software. The vulnerability can be exploited to bypass
authentication and gain administrative access to the Task Freak system.


Systems affected:
- ------------------

Task Freak Multi User / mySQL v0.6.2 with Tirzen Framework 1.5 was tested
and shown to be vulnerable.


Impact
- -------

Attackers could manipulate database query strings resulting in information
disclosure, data destruction, authentication bypass, etc.



Technical discussion and proof of concept:
- -------------------------------------------

Tirzen Framework class TznDbConnection in the function loadByKey()
(tzn_mysql.php line 605) manifests a SQL injection vulnerability because it
fails to sanitize user supplied input used to compose SQL statements.


Proof of concept: any user can log into TaskFreak as the administrator
simply by using the username "1' or 1='1"


Vendor response:
- ----------------

Upgrade to the latest version of TaskFreak.



- --
Justin C. Klein Keane

http://www.MadIrish.net