r00tsecurity -> Exploit & Advisory Center :: LinPha 1.3.4 SQL Injection

[ Log In | Register ]

Resource Database Index -> Exploits & Advisories -> LinPha 1.3.4 SQL Injection

Description // Info

Homepage: http://linpha.sourceforge.net/wiki/index.php/Main_Page

LinPHA is an easy to use, multilingual, flexible photo/image archive/album/gallery written in PHP. It uses a SQL database (MySQL/PostgreSQL/SQLite) to store information about your pictures.

Looking in the function linpha_addslashes() function...
[]
linpha_addslashes($str) { if(DB_TYPE == \'sqlite\') { $str =
str_replace(\"\'\",\"\'\'\",$str); } else { $str = addslashes($str); } return
$str; }
[]

As we can plainly see all that\'s really sanitized is a single quote in sqlite and in mysql just \\, \', \", and null, none of these are needed to execute arbitrary SQL code and therefore every instance of executing queries where the variable can be set by the user with this function is vulnerable [About 20 instances by my count].

Exploit // Proof of Concept

Pretty much every file that executes sql queries where the variable can be set by the attacker is vulnerable because their cleaning method doesn\'t sanitize....one example is viewer.php which calls to the function \\get_albid($prev_path, $stage) in /functions/other.php which contains: 
[]
$select = $GLOBALS[\'db\']->Execute(\"SELECT ID FROM
\".PREFIX.$query.\"_lev_album WHERE path =
\'\".linpha_addslashes($prev_path).\"\'\");
[]
Again above we cleared up that linpha_addslashes really helps nothing...So now we jump to viewer.php to see what was put for $prev_path:
$_GET[\'albid\'] = get_albid($_GET[\'album\'],$_GET[\'stage\']);

Therefore
http://www.site.com/path/viewer.php?album=[SQL]&pn=1

Comments

You must be logged in to post comments.

Exploit Information

Type:
Remote - Web Application

Vendor:
Sourceforge

Product:
LinPHA PHP Photo Gallery

Versions Effected:
<= 1.3.4

Submitted:
2009-09-22 - 19:51:15

Author:
Order Zero
E-Mail
Website

Greetz:
# Barney-, sToRm, and ofcourse m0nkee

[ Download | Report Issue ]

Exploit Search

Search by Type
+ Remote
+ Local
+ Application/Service
+ Web Application
+ Kernel
+ Operating System
+ Bug
+ Overflow
+ Shellcode
+ DOS
+ Advisory

Advanced Search