BugTracker.NET 3.4.3 SQL Injection

`BugTracker.net 3.4.3 SQL Injection  
  
Name BugTracker.NET  
Vendor http://www.ifdefined.com/www/  
Versions Affected < 3.4.4 (when custom fields are used)  
  
Author Mark van Tilburg  
Website http://markvt.info  
Contact markvantilburg [at] gmail [dot] com  
Date 2010-08-22  
  
X. INDEX  
  
I. ABOUT THE APPLICATION  
II. DESCRIPTION  
III. ANALYSIS  
IV. SAMPLE CODE  
V. FIX  
VI. Dates  
  
  
I. ABOUT THE APPLICATION  
________________________  
  
A web-based bug or issue tracker written using ASP.NET,  
C#, and SQL Server (SQL Server Express too).  
Probably has all the features you need. Easy to setup.  
Power and flexibility when you need it. Learn more at  
http://ifdefined.com/bugtrackernet.html  
  
  
II. DESCRIPTION  
_______________  
  
A parameter is not properly sanitised before being  
used in SQL queries.  
  
If no custom fields are used this vulnerability  
cannot be misused.  
  
  
III. ANALYSIS  
_____________  
  
Summary:  
  
A) SQL Injection  
_______________________________  
  
The application allows the use of Custom Fields, searching  
of these custom fields is possible on the search page.  
The value used for searching the custom field is not  
properly cleaned before being used in the SQL query.  
  
Please note this vulnerability is in the code lot for a long time  
if using BugTracker.NET publicly you could be vulnerable.  
  
IV. SAMPLE CODE  
_______________  
  
Use ' in the search box of a custom field  
  
V. FIX  
______  
  
A) Don't use custom fields  
  
B) Upgrade to v3.4.4 (http://sourceforge.net/projects/btnet/files/)  
  
C) Or do the fix manually by following the steps at:  
http://btnet.svn.sourceforge.net/viewvc/btnet/www/search.aspx?r1=559&r2=566  
  
VI. DATES  
______  
Reported to author: 2010-08-20  
Acknowledge by author: 2010-08-20  
Fixed by author: 2010-08-22  
`