iGiveTest 2.1.0 SQL Injection Vulnerability

################################################################################
### iGiveTest 2.1.0 SQL Injection Vulnerability
################################################################################
~ Brendan Coles < bcoles at gmail dot com > ~ 2011-03-20

# Summary :

		There is an SQL Injection vulnerability in iGiveTest 2.1.0 which may allow 
		an attacker to take control of the software.


# Software :

		# Software Link: iGiveTest ( http://iGiveTest.com ) 
		# Vulnerable Version(s): <= 2.1.0
		# Vendor Notification:
			# [2011-03-20] [email protected] and [email protected]
			# [2011-03-22] Received vender confirmation.
			# [2011-06-22] No patch available. Advisory released.

# Vulnerability Reference :

		# SQL Injection : http://www.owasp.org/index.php/SQL_Injection
		# Cross-Site Request Forgery (CSRF) : http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)


# SQL Injection # <= 2.1.0 # Unpatched:
		
		The vulnerability is due to failure in "/users.php" to correctly sanitize 
		user-supplied data in the "userids" parameter.

		A user with "guest" level privilages, or higher, can execute arbitrary SQL 
		commands. An attacker without privilages could leverage an authorized user's 
		session via a Cross-Site Request Forgery (CSRF) if the user browses a 
		malicious page during an authorized session.

		The following proof of concept is available :

		http://try001.igivetest.net/users.php?action=groups&order=-1&userids=-1) union select 1,concat(user_name,0x3a,user_passhash),user_email,user_firstname,user_lastname,6,7 from users,groups where (1



#  0day.today [2018-01-02]  #