social-sql.txt

`[HACKATTACK Advisory 2008-11-20]Social Engine 2.7 CRLF Injection + SQL injection  
  
Details  
************************  
Product: Social Engine  
Security-Risk: moderate  
Remote-Exploit: yes  
Vendor-URL: http://www.socialengine.net/  
Vendor-Status: informed  
Advisory-Status: published  
  
Credits  
************************  
Discovered by: David Vieira-Kurz of HACKATTACK IT SECURITY GmbH  
http://www.HACKATTACK.at || http://www.HACKATTACK.eu  
  
Affected Products:  
----------------------------  
Social Engine 2.7 and prior  
  
Original Advisory:  
************************  
http://www.HACKATTACK.at/  
http://www.HACKATTACK.eu/  
Introduction  
************************  
SocialEngine is a PHP-based social network platform that lets you create a social network on your website.  
  
More Details  
************************  
1. SQL Injection:  
---------------------  
Input passed to the POST variable "comment_secure" parameter in "profile_comments.php" is not properly sanitised before being used in a SQL query.  
  
  
2. Cookie_Manipulation:  
---------------------  
The cookie variable "PHPSESSID" is not properly sanitized before being used.  
This can be exploited by injecting arbitrary custom headers using a carriage return linefeed injection.   
  
  
Solution  
************************  
Edit the source code to ensure that input is properly sanitised.  
You should work with "htmlspecialchars()" or "htmlentities()" php-function to ensure that html tags  
are not going to be executed. You should also work with the "mysql_real_escape_string()" php-function to ensure that sql statements  
can't be delivered over the "get" variables. It's also possible to turn on magic_quotes, depending on how you handle the quotes inside  
of your script to make sure magic_quotes doesn't double escape the quotes.   
  
Example:  
# clean = array();  
# $html = array();  
# $html['username'] = htmlentities($clean['username'],ENT_QUOTES,UTF-8');   
?>  
  
About HACKATTACK  
================  
HACKATTACK IT SECURITY GmbH is a Penetrationtest and security Auditing company located in Austria and Germany.  
  
Hotline Germany +49 (0)800 20 60 900  
Hotline Austria +43 (0)06223 20 6210  
More Information about HACKATTACK at  
http://www.HACKATTACK.at || http://www.HACKATTACK.eu  
`