-- Salvatore Fresta aka Drosophila http://www.salvatorefresta.net CWNP444351 iScripts CyberMatch 1.0 Blind SQL Injection Vulnerability Name iScripts CyberMatch Vendor http://www.iscripts.com Versions Affected 1.0 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date 2010-02-07 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX I. ABOUT THE APPLICATION iScripts CyberMatch is a turnkey online dating software for you to start a full-fledged dating site like match.com or eHarmony in minutes. iScripts CyberMatch can be used to create your own Dating, Personals or match making Site, Adult or Matrimonial Site. II. DESCRIPTION A parameter is not properly sanitised before being used in a SQL query. III. ANALYSIS Summary: A) Blind SQL Injection A) Blind SQL Injection The id parameter in profile.php is not properly sanitised before being used in a SQL query. That is not the query which selects the information about the user specified by the id parameter but is the query that selects the image's name. The affected query is a query of five fields. When the injected condition is true, in the page will be printed the real link to the personal image of the user specified by the id parameter, otherwise a link to bignophoto.gif. True condition: http://site/path/images/profiles/id_random.jpg False condition: http://site/path/images/profiles/bignophoto.gif Successful exploitation requires that "magic_quotes_gpc" is disabled and that the user specified by id parameter has posted an image. IV. SAMPLE CODE A) Blind SQL Injection http://site/path/profile.php?id=10' UNION SELECT 1,2,3,4,5%23 http://site/path/profile.php?id=10' AND 1=1%23 http://site/path/profile.php?id=10' AND 1=0%23 V. FIX No Fix.