SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   Application (Forum/Board/Portal)  >   jPORTAL Vendors:   Jaczewski, Pawel
jPORTAL Input Validation Hole Lets Remote Users Inject SQL Commands
SecurityTracker Alert ID:  1010327
SecurityTracker URL:  http://securitytracker.com/id/1010327
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  May 28 2004
Impact:   Disclosure of user information, Modification of user information
Exploit Included:  Yes  

Description:   An input validation vulnerability was reported in jPORTAL. A remote user can inject SQL commands.

Maciek Wierciski reported that 'module/print.inc.php' does not filter user-supplied data, allowing a remote user to submit a specially crafted query to execute SQL commands on the underlying database.

A demonstration exploit URL is provided:

http://xxxxx/print.php?what=article&id=X AND 1=0 UNION SELECT id,id,nick,pass,id,id,id,id,id from admins LIMIT 1

The report indicates that there are additional flaws in the code.

Impact:   A remote user can execute SQL commands on the underlying database.
Solution:   No solution was available at the time of this entry.
Vendor URL:  jportal2.com/ (Links to External Site)
Cause:   Access control error, Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  JPortal SQL Injects




Jportal is a portal system, quite commonly used:

(Google)
Results 1 - 10 of about 56,100 for "powered by jportal". (0.22 seconds) 

Homepage:
http://jportal2.com/

I've read its code and found:

in module/print.inc.php:

function art_print() {
....
$query = "SELECT * FROM $art_tbl WHERE id=$id";
...
}

What to say? ;]

example exploitation:
http://xxxxx/print.php?what=article&id=X AND 1=0 UNION SELECT id,id,nick,pass,id,id,id,id,id from admins LIMIT 1

result: unhashed admin password.

There are a lot more bugs in it, imho whole system should be rewritten from a scratch (also using password hashing is a good thing
 i think :)

Maciek 'ziemniaq' Wierci?ski

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2018, SecurityGlobal.net LLC