[UNIX] Invision Power Top Site List SQL Injection

From: SecuriTeam (support_at_securiteam.com)
Date: 12/18/03

  • Next message: SecuriTeam: "[NEWS] Buffer Overflow Allows Privileges Escalation in MacOS X" 
    To: list@securiteam.com
Date: 18 Dec 2003 17:04:25 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Invision Power Top Site List SQL Injection
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.invisiontsl.com/> Invision Power Top Site List is "a flexible
    site ranking script written in PHP, the popular programming choice for web
    developers. Featuring an impressive feature set with a user-friendly
    interface". Invision Power Top Site List is vulnerable to SQL injection
    vulnerability due to not properly sanitizing user input via the "offset"
    parameter.

    DETAILS

    Vulnerable systems:
     * Invision Power Top Site List version 1.0
     * Invision Power Top Site List version 1.1

    The following GET request will trigger the SQL query syntax error:
    http://vulnerablesite/index.php?offset=[%20Problem%20Here%20]

    Error message:
    Error: Error executing query

    The software returned the following error:
    You have an error in your SQL syntax near '[ Problem Here ],20' at line 14

    Query Executed: SELECT s.*,COUNT(DISTINCT c.id) as comment_count,
    AVG(v.value)
    as rating,COUNT(DISTINCT v.id) as num_votes,COUNT(DISTINCT me.id) as
    already_voted
    FROM tsl_sites AS s, tsl_users AS u, tsl_emails AS e LEFT JOIN
    tsl_categories AS
    cat ON cat.id = s.category LEFT JOIN tsl_votes AS v ON v.site = s.id LEFT
    JOIN
    tsl_ip_address AS ipa ON ipa.address = "24.117.153.131" LEFT JOIN
    tsl_ip_records
    AS ipr ON ipr.id = ipa.record LEFT JOIN tsl_votes AS me ON me.site =
    s.id && me.ip_record = ipr.id LEFT JOIN tsl_comments AS c ON c.site = s.id
    &&
    c.admin_validate = 1 WHERE s.user = u.id && s.email = e.id && u.blocked =
    0 &&
    s.active = 1 && s.admin_validate = 1 && e.validated = 1 GROUP BY s.id
    ORDER BY
    out_count DESC, rating DESC, in_count DESC, name DESC LIMIT [ Problem Here
    ],20

    Vendor status:
    The Invision Team was very prompt and professional in getting back to me
    about this. Because of the difficulty of exploitation there will be no
    patch or immediate upgrade released. However, the issue will be addressed
    in the next release of Invision Top Sites List.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:security@gulftech.org>
    JeiAr.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Buffer Overflow Allows Privileges Escalation in MacOS X"

    Relevant Pages