79 lines
No EOL
1.8 KiB
Text
79 lines
No EOL
1.8 KiB
Text
iScripts CyberMatch 1.0 Blind SQL Injection Vulnerability
|
|
|
|
Name iScripts CyberMatch
|
|
Vendor http://www.iscripts.com
|
|
Versions Affected 1.0
|
|
|
|
Author Salvatore Fresta aka Drosophila
|
|
Website http://www.salvatorefresta.net
|
|
Contact salvatorefresta [at] gmail [dot] com
|
|
Date 2010-02-07
|
|
|
|
X. INDEX
|
|
|
|
I. ABOUT THE APPLICATION
|
|
II. DESCRIPTION
|
|
III. ANALYSIS
|
|
IV. SAMPLE CODE
|
|
V. FIX
|
|
|
|
|
|
I. ABOUT THE APPLICATION
|
|
|
|
iScripts CyberMatch is a turnkey online dating software
|
|
for you to start a full-fledged dating site like
|
|
match.com or eHarmony in minutes. iScripts CyberMatch can
|
|
be used to create your own Dating, Personals or match
|
|
making Site, Adult or Matrimonial Site.
|
|
|
|
|
|
II. DESCRIPTION
|
|
|
|
A parameter is not properly sanitised before being used in
|
|
a SQL query.
|
|
|
|
|
|
III. ANALYSIS
|
|
|
|
Summary:
|
|
|
|
A) Blind SQL Injection
|
|
|
|
|
|
A) Blind SQL Injection
|
|
|
|
The id parameter in profile.php is not properly sanitised
|
|
before being used in a SQL query. That is not the query
|
|
which selects the information about the user specified by
|
|
the id parameter but is the query that selects the image's
|
|
name. The affected query is a query of five fields.
|
|
|
|
When the injected condition is true, in the page will be
|
|
printed the real link to the personal image of the user
|
|
specified by the id parameter, otherwise a link to
|
|
bignophoto.gif.
|
|
|
|
True condition:
|
|
http://site/path/images/profiles/id_random.jpg
|
|
|
|
False condition:
|
|
http://site/path/images/profiles/bignophoto.gif
|
|
|
|
Successful exploitation requires that "magic_quotes_gpc"
|
|
is disabled and that the user specified by id parameter
|
|
has posted an image.
|
|
|
|
|
|
IV. SAMPLE CODE
|
|
|
|
A) Blind SQL Injection
|
|
|
|
http://site/path/profile.php?id=10' UNION SELECT 1,2,3,4,5%23
|
|
|
|
http://site/path/profile.php?id=10' AND 1=1%23
|
|
http://site/path/profile.php?id=10' AND 1=0%23
|
|
|
|
|
|
V. FIX
|
|
|
|
No Fix. |