BugTracker.net 3.4.3 SQL Injection Name BugTracker.NET Vendor http://www.ifdefined.com/www/ Versions Affected < 3.4.4 (when custom fields are used) Author Mark van Tilburg Website http://markvt.info Contact markvantilburg [at] gmail [dot] com Date 2010-08-22 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX VI. Dates I. ABOUT THE APPLICATION ________________________ A web-based bug or issue tracker written using ASP.NET, C#, and SQL Server (SQL Server Express too). Probably has all the features you need. Easy to setup. Power and flexibility when you need it. Learn more at http://ifdefined.com/bugtrackernet.html II. DESCRIPTION _______________ A parameter is not properly sanitised before being used in SQL queries. If no custom fields are used this vulnerability cannot be misused. III. ANALYSIS _____________ Summary: A) SQL Injection _______________________________ The application allows the use of Custom Fields, searching of these custom fields is possible on the search page. The value used for searching the custom field is not properly cleaned before being used in the SQL query. Please note this vulnerability is in the code lot for a long time if using BugTracker.NET publicly you could be vulnerable. IV. SAMPLE CODE _______________ Use ' in the search box of a custom field V. FIX ______ A) Don't use custom fields B) Upgrade to v3.4.4 (http://sourceforge.net/projects/btnet/files/) C) Or do the fix manually by following the steps at: http://btnet.svn.sourceforge.net/viewvc/btnet/www/search.aspx?r1=559&r2=566 VI. DATES ______ Reported to author: 2010-08-20 Acknowledge by author: 2010-08-20 Fixed by author: 2010-08-22