Green Minute userscript.php Multiple Variable SQL Injection

2006-04-20T06:11:51
ID OSVDB:25207
Type osvdb
Reporter r0t(krustevs@googlemail.com)
Modified 2006-04-20T06:11:51

Description

Vulnerability Description

Green Minute has been reported to contain an SQL injection flaw in the userscript.php script. The original report indicates that multiple variables fail to sanitize input before passing it to the database for processing. After vendor contact and subsequent testing, it appears that user input is properly sanitized. It is believed that the SQL error message output on a failed query was mistaken for indication of injection ability.

Solution Description

The vulnerability reported is incorrect. No solution required.

Short Description

Green Minute has been reported to contain an SQL injection flaw in the userscript.php script. The original report indicates that multiple variables fail to sanitize input before passing it to the database for processing. After vendor contact and subsequent testing, it appears that user input is properly sanitized. It is believed that the SQL error message output on a failed query was mistaken for indication of injection ability.

Manual Testing Notes

/userscript.php?command=select&date=&phase=2&huserid=[SQL]

/userscript.php?command=select&phase=2&date=&pituus=[SQL]

/userscript.php?command=select&phase=2&date=[SQL]

References:

Vendor URL: http://hoito.org/en/products/ Vendor Specific Advisory URL Other Advisory URL: http://pridels.blogspot.com/2006/04/green-minute-sql-inj-vuln.html Mail List Post: http://attrition.org/pipermail/vim/2006-May/000790.html ISS X-Force ID: 25942 CVE-2006-1930