POWER PHLOGGER v.2.2.5 (username) SQL Injection

2007.06.28
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

POWER PHLOGGER v.2.2.5 (username) SQL Injection Author: Attila Gerendi (Darkz) Date: December 20, 2005 Package: POWER PHLOGGER (http://www.phpee.com/) Versions Affected: v.2.2.5 (Other versions may also be affected) Severity: SQL Injection Description: Input passed to the "username" parameter in "login.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and bypass login sequence. This SQL injection is "blind" so the user can not produce variations in the server input however using BENCHMARK it still can be used to retrieve sensitive data from the database and/or heavily load the server and produce DDOS attack. The vulnerable code piece is in "/include/get_userdata.php" /* assign the user's values */ $sql = "SELECT * FROM ".PPHL_TBL_USERS." WHERE id='$id' OR username='$id'"; $res = mysql_query($sql); the vulnerable parameter at this point is $id and it is set trough session variable $username from login.php without any sanitation. Status: The product web page say: "Active development of PowerPhlogger has been stopped as of August 2006. The announced successor Phlogger3 will not be released. Also, I am not able to provide you with support for any previous version.", so any user using this version should correct the bug herself. Solution: modify /* assign the user's values */ $sql = "SELECT * FROM ".PPHL_TBL_USERS." WHERE id='$id' OR username='$id'"; $res = mysql_query($sql); to /* assign the user's values */ $id = mysql_escape_string($id); $sql = "SELECT * FROM ".PPHL_TBL_USERS." WHERE id='$id' OR username='$id'"; $res = mysql_query($sql);


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top