olatedownload-sql.txt

`-Summary-  
Software: Olate Download  
Sowtwares Web Site: http://www.olate.co.uk/  
Versions: 3.4.2  
Class: Remote  
Status: Unpatched  
Exploit: Available  
Solution: Not Available  
Discovered by: imei addmimistrator  
Risk Level: Middel  
Description  
Olate download is prone to SQL injection in download.php file.  
Lack of programmers knowledge about HTTP headers and process of assigning value to predefined global arrays, resulted to this bug.With a shallow look, on line app. 118-127 youll understand that programmers trusted to headers HTTP_REFERER and HTTP_USER_AGENT, unaware that hackers can modify them for his abuse.  
code:119,download.php  
$dbim->query(INSERT INTO .DB_PREFIX.stats  
SET file_id = .$_REQUEST[file].,  
timestamp = .time().,  
ip = .$_SERVER[REMOTE_ADDR].,  
referrer = xx.$_SERVER[HTTP_REFERER].,  
user_agent = .$_SERVER[HTTP_USER_AGENT].);  
Exploit-  
headers:  
reffered: sql  
OR  
user agent: sql  
Solution  
Not any updates available~  
Credit  
Discovered by: imei addmimistrator  
addmimistrator(4}gmail(O}com  
www.myimei.com  
  
`