SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   phpFaber TopSites Vendors:   phpFaber
phpFaber TopSites Missing Input Validation in 'i_cat' and 'method' Parameters Lets Remote Users Inject SQL Commands
SecurityTracker Alert ID:  1016552
SecurityTracker URL:  http://securitytracker.com/id/1016552
CVE Reference:   CVE-2006-3770   (Links to External Site)
Updated:  Jun 13 2008
Original Entry Date:  Jul 21 2006
Impact:   Disclosure of system information, Disclosure of user information, User access via network
Exploit Included:  Yes  
Version(s): 2.0.9 and prior versions
Description:   A vulnerability was reported in phpFaber TopSites. A remote user can inject SQL commands.

The 'index.php' script does not properly validate user-supplied input in the 'i_cat' and 'method' parameters. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.

The original advisory is available at:

http://www.majorsecurity.de/advisory/major_rls21.txt

David 'Aesthetico' Vieira-Kurz of MajorSecurity discovered this vulnerability.

Impact:   A remote user can execute SQL commands on the underlying database.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.phpfaber.com/i/products/topsites/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [MajorSecurity #21] phpFaber TopSites <=2.0.9 - SQL Injection

[MajorSecurity #21] phpFaber TopSites <=2.0.9 - SQL Injection Vulnerability

-----------------------------------------------------------------


Software: phpFaber TopSites 


Version: <=2.0.9


Type: SQL Injection Vulnerability


Made public: July, 19th 2006 


Vendor: phpFaber, LLC


Page: http://www.phpfaber.com/



Credits:

----------------------------------------------

Discovered by: David "Aesthetico" Vieira-Kurz

http://www.majorsecurity.de


Original Advisory:

----------------------------------------------

http://www.majorsecurity.de/advisory/major_rls21.txt


Affected Products:

----------------------------------------------

phpFaber TopSites 2.0.9 and prior


Description:

----------------------------------------------

phpFaber TopSites is a feature-packed, reliable and secure Top List for webmasters who want to increase traffic to their websites.

It is fully customizable and doesn't require any programming skills! You can create your forms just in 3 clicks!


Vulnerability:

----------------------------------------------

Input passed directly to the "i_cat" and "method" parameter in "index.php" is not properly sanitised before being used in a SQL query.

This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.


Solution:

----------------------------------------------

Edit the source code to ensure that input is properly sanitised.












    

    

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC