phpCollegeExchange 0.1.5c Multiple SQL Injection Vulnerabilities



phpCollegeExchange 0.1.5c Multiple SQL Injection Vulnerabilities

Name phpCollegeExchange
Vendor http://phpcollegeex.sourceforge.net
Versions Affected 0.1.5c

Author Salvatore Fresta aka Drosophila
Website http://www.salvatorefresta.net
Contact salvatorefresta [at] gmail [dot] com
Date 2009-12-11

X. INDEX

I. ABOUT THE APPLICATION
II. DESCRIPTION
III. ANALYSIS
IV. SAMPLE CODE
V. FIX
VI. DISCLOSURE TIMELINE


I. ABOUT THE APPLICATION

PhpCollegeExchange is a full fledged college community
website.


II. DESCRIPTION

This application is affected by many SQL Injection
security flaws. In order to exploit they, the Magic Quotes
GPG (php.ini) must be Off.
In this security advisory I reported only some of the
vulnerable files.
I tested 0.1.5c version only, however other versions may
be also vulnerable.


III. ANALYSIS

Summary:

A) Authentication Bypass
B) Multiple SQL Injection

A) Authentication Bypass

Using a SQL Injection in the login process, a guest can
bypass the authentication.
In order to exploit it, The Magic Quotes GPG flag must be
Off.

Vulnerable code (functions.php):

........

function checkpass($handle,$pass){
require_once($home."mysqlinfo.php");
include("i_aeskey.php");
$query="SELECT AES_DECRYPT(password,'$AES_key') FROM users WHERE
(handle='$handle')";
$result = mysql_query($query);

if(mysql_num_rows($result))
{
if($r = mysql_fetch_array($result))
{$dbpass=$r[0];}
if($pass==$dbpass)
{return 1;}

........


B) Multiple SQL Injection

Searchend.php is affected by multiple SQL injection issues
that allow a guest to view reserved information stored
into the database.
The following is an example of vulnerable code found in
searchend.php.

Vulnerable code (searchend.php):

........

$query = "SELECT * FROM Books";

if(isset($_POST['searchby'])){$searchby=$_POST['searchby'];}else{$searchby=$_GET['searchby'];}

switch($searchby){

........

case "Title" :

$title = $_POST['searchquery'];
if(strlen($title)>2){
//check length at least 3 chars

$query .= " WHERE (title LIKE '%$title%') ORDER BY price";
$result = mysql_query($query);

........

Another funny SQL injection may be seen in forgotpass.php.
It can be manipulate to send to an arbitrary email address
the password of a registered user, knowing the AES key.

Vulnerable code:

........

if( isset($_POST["handle"]) ){

........

$query="SELECT AES_DECRYPT(password,'$AES_key'), email FROM users
WHERE (handle='$handle')";
$result = mysql_query($query);

if(mysql_num_rows($result)){

$r = mysql_fetch_array($result);

$email = $r[1];
$pass = $r[0];

........

mail("$email", "Your Book Exchange Password", $emailcontent);

........


IV. SAMPLE CODE

A) Authentication Bypass

Username: -1') UNION ALL SELECT 'foo'#
Password: foo

B) Multiple SQL Injection

A proof of concept can be found here:
http://poc.salvatorefresta.net/PoC-phpCollegeExchange.txt


V. FIX

No fix.


VIII. DISCLOSURE TIMELINE

2009-12-11 Bug discovered
2009-12-11 Initial vendor contact
2009-12-11 Advisory Release



Relevant Pages