[waraxe-2007-SA#055] - Sql Injection in SiteX CMS 0.7.3 Beta ==================================================================== Author: Janek Vind "waraxe" Date: 27. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-55.html Target software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://sitex.bjsintay.com/ SiteX is a versitile web tool that will enable you to start your own dynamic website in under 5 minutes. Driven by PHP and MySQL, SiteX consists of components common to most personal and professional websites. Vulnerabilities: Sql Injection in "search.php" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Let's analyze "search.php" source code: ------------>[source code]<------------ if(isset($_GET['search'])) $search = stripslashes($search); $search = trim(stripslashes($search)); ... $sxPhotoResults = sxPhotoSearchResults($search); ------------>[/source code]<----------- As we can see, stripslashes() is used against search string, so that "magic_quotes" will not help against sql injection. And following function "sxPhotoSearchResults()" is not sanitizing search string either. So let's have a test: http://victim.com/search.php?search=O'Brien and we get nice error message: SiteX experienced error #1 with an SQL bash readout of : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Brien%' OR SiteX_Photos.name LIKE '%O'Brien%' OR SiteX_Photos.description LIKE '' at line 2 Yep, sql injection exists here. Now, some facts about this injection: 1. This seems to be exploitable only as blind sql injection. I have written proof-of-concept exploit for this and it is working as expected. 2. "magic_quotes" does not matter, because "stripslashes()" is used. 3. "register_globals" is not important either, because attack comes from "$_GET". Greetings: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Greets to ToXiC, LINUX, y3dips, Sm0ke, Heintz, slimjim100, Chb and all other people who know me! Greetings to Raido Kerna. Tervitusi Torufoorumi rahvale! Contact: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ come2waraxe (at) yahoo (dot) com [email concealed] Janek Vind "waraxe" Homepage: http://www.waraxe.us/ Shameless advertise: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Astronomy books - http://astronomy.oldreadings.com/ User Manuals - http://user-manuals.waraxe.us/ ---------------------------------- [ EOF ] ------------------------------------