invisionPTSL11.txt

`  
  
Vendor : Invision Power Services  
URL : http://www.invisiontsl.com  
Version : Invision Power Top Site List v1.1 RC 2 && Earlier  
Risk : SQL Injection Vulnerability  
  
  
  
Description:  
Invision Power Top Site List is a flexible site ranking script   
written in PHP, the popular programming choice for web developers.   
Featuring an impressive feature set with a user-friendly interface   
your community will feel at home using the system.   
  
  
  
SQL Injection Vulnerability:  
Invision Power Top Site List is prone to an SQL Injection vuln  
in its "comment" feature. This issue is very much exploitable as  
the injection happens right in the middle of a WHERE statement.  
Lets have a look at an example error message to get a better idea  
of what is going on.  
  
-----[ Start Error ]---------------------------------------------  
  
Error: Error executing query  
  
The software returned the following error:  
  
You have an error in your SQL syntax. Check the manual that   
corresponds to your MySQL server version for the right syntax   
to use near '[ Evil_Query ]' at line 1  
  
Query Executed: SELECT * FROM tsl_sites WHERE id = [Evil_Query]  
  
-----[ /Ends Error ]---------------------------------------------  
  
As we can see from this it would be of little difficulty for any  
attacker to execute arbitrary requests. For example pulling the  
admin hash and/or possibly taking admin control over an affected  
Invision Power Top Site List. Below is an example url to show how  
the issue could be exploited.  
  
index.php?act=comments&id=[Evil_Query]  
  
  
  
Solution:  
The Invision Power Services team were contacted immediately and  
hopefully a fix will be available soon since this is an application  
that cost users money to use. The original advisory can be found  
at the following url @ http://www.gulftech.org/03212004.php  
  
  
  
Credits:  
Credits go to JeiAr of the GulfTech Security Research Team.   
http://www.gulftech.org  
`