SVadvisory#13

---

title: SQL injection
product: MYFAQ
version: V1.0
site: http://vpontier.free.fr/

---

=====================================================================================
Vulnerability

1) affichagefaq.php3 Code:

<?php
…

    $Requete = "SELECT LIBELLE FROM THEMES WHERE ID_THEME = $Theme";
    $Liste = mysql_db_query($Base,$Requete);
    $Ret = mysql_fetch_array($Liste);
 
 ....

    $Requete = "SELECT LIBELLE FROM SOUSTHEMES WHERE ID_SOUSTHEME = $SousTheme";
    $Liste = mysql_db_query($Base,$Requete);
    $Ret = mysql_fetch_array($Liste);

 ....

    $Requete="SELECT * FROM SOLUTIONS WHERE ID_FAQ = $Question";
    $Liste = mysql_db_query($Base,$Requete);

?>

Variable $Theme, $SousTheme, $Question is not filtered on presence dangerous
symbol that can bring about SQL injection.

2) choixsoustheme.php3 code:

<?php
…

    $Requete = "SELECT * FROM THEMES WHERE ID_THEME = $Theme";
    $TitreTh = mysql_query($Requete,$Connect_MySql);

 ....

?>

In the same way in file choixsoustheme.php3, variable $Theme is not filtered
on presence dangerous symbol that can bring about SQL injection

3) consultation.php3 code:

<?php
…

    $Requete = "SELECT * FROM FAQ WHERE ID_THEME = $Theme AND ID_SOUSTHEME = $SousTheme ORDER BY

DATECRE;";
$ListeFaq = mysql_db_query($Base,$Requete);

 ....

    $Requete = "SELECT * FROM THEMES WHERE ID_THEME = $Theme;";
    $TitreTh = mysql_query($Requete,$Connect_MySql);

 ....

    $Requete = "SELECT * FROM SOUSTHEMES WHERE ID_SOUSTHEME = $SousTheme";
    $TitreSTh = mysql_db_query($Base,$Requete);

 ....
?>

Variable $Theme, $SousTheme are not filtered on presence dangerous symbol,
>From - for this appears criticality SQL injection

4) inssolution.php3 code:

 <?php 
   ....
   
       $Requete = "SELECT * FROM FAQ WHERE ID_FAQ = $Faq";
       $ResIns = mysql_db_query($Base,$Requete); 
   
   ....
 ?>

Variable $Faq is not filtered on presence dangerous symbol that brings
about criticality SQL injection

=======================================================================================
In the same way in following file variable $Theme, $SousTheme and $Faq are not
filtered on presence dangerous symbol:

$Theme $SousTheme $Faq

---

insfaq.php3 insfaq.php3 saisiefaq.php3
inssoustheme.php3 inssoustheme.php3 voirfaq.php3
instheme.php3 saisiefaq.php3
saisiefaqtotale.php3 saisiefaqtotale.php3
saisiesoustheme.php3 voirfaq.php3
voirfaq.php3

More new versions does not contain these criticality

Bug found

CENSORED ~ Search Vulnerabilities Team ~ http://svt.nukleon.us