U.S. Geological Survey Website SQL Injection

`Title:  
======  
U.S. Geological Survey Website - SQL Injection Vulnerability  
  
  
Date:  
=====  
2011-09-21  
  
  
References:  
===========  
http://www.vulnerability-lab.com/get_content.php?id=278  
  
  
VL-ID:  
=====  
278  
  
  
Introduction:  
=============  
The United States Geological Survey (USGS) is a scientific agency of the United States government. The scientists of the   
USGS study the landscape of the United States, its natural resources, and the natural hazards that threaten it. The   
organization has four major science disciplines, concerning biology, geography, geology, and hydrology. The USGS is a   
fact-finding research organization with no regulatory responsibility.  
  
A bureau of the United States Department of the Interior, it is that department s sole scientific agency. The USGS employs   
approximately 8,670 people and is headquartered in Reston, Virginia. The USGS also has major offices in Lakewood,   
Colorado (Denver Federal Center), and Menlo Park, California. The motto of the USGS is > Science for a changing world.  
  
(Copy of the Vendor Homepage: http://en.wikipedia.org/wiki/United_States_Geological_Survey )  
  
  
Abstract:  
=========  
A Vulnerability Laboratory researcher discovered a critical SQL Injection vulnerability on the U.S. Geological Survey website.  
  
  
Report-Timeline:  
================  
2011-09-20: Vendor Notification  
2011-09-20: Vendor Response/Feedback  
2011-09-21: Vendor Fix/Patch  
2011-09-21: Public or Non-Public Disclosure  
  
  
Status:  
========  
Published  
  
  
Affected Products:  
==================  
  
Exploitation-Technique:  
=======================  
Remote  
  
  
Severity:  
=========  
Critical  
  
  
Details:  
========  
A critical SQL Injection vulnerability is detected on the U.S. Geological Survey website (USGS).  
The vulnerability allows an remote attacker to inject/execute own SQL statements over the affected   
vulnerable parameter on the website application dbms.  
  
Vulnerable Program(s):  
[+] Volcano Hazards Program  
  
Vulnerable Module(s):  
[+] vona.php  
  
Vulnerable Param(s):  
[+] id  
  
  
Reference:  
http://[SERVER].[GOV]/[PATH]/[FILE].[PHP]?[PARAM]=-x+[SQL-INJECTION]  
  
Picture(s):  
../1.png  
  
  
Proof of Concept:  
=================  
The vulnerability can be exploited by remote attackers. For demonstration or reproduce ...  
  
Reference:  
http://[SERVER].[GOV]/[PATH]/[FILE].[PHP]?[PARAM]=-164+[SQL-INJECTION]  
  
PoC:  
http://volcanoes.usgs.gov/activity/vona.php?id=-164+union+select+1,2,3,4,version()--  
  
  
Solution:  
=========  
2011-09-21: Vendor Fix/Patch  
  
  
Risk:  
=====  
The security risk of the remote sql injection vulnerability is estimated as critical(+).  
  
  
Credits:  
========  
Vulnerability Research Laboratory - Chokri B.A. (Me!ster)   
[http://www.vulnerability-lab.com/show.php?user=Chokri%20-%20B.A]  
  
  
Disclaimer:  
===========  
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,   
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-  
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business   
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some   
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation   
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-  
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of   
other media, are reserved by Vulnerability-Lab or its suppliers.  
  
Copyright © 2011|Vulnerability-Lab  
  
  
  
  
  
  
--   
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com  
Contact: [email protected] or [email protected]  
  
  
`