SQL Injection Vulnerabilities:
Invision Gallery seems to come up very short concerning validation
of user supplied input. It is vulnerable to a number of SQL Injection
vulnerabilities. Also, because Invision Gallery is integrated into
Invision power Board it is VERY much possible for an attacker to use
the vulnerabilities in Invision Gallery to affect the Invision Power
Board which it resides on. Most of the non validated input that allow
for the injections take place right in the middle of a WHERE statement
making them that much easier to exploit. Lets look at an example error.
-----[ Start Error ]---------------------------------------------
mySQL query error: SELECT * FROM ibf_gallery_categories WHERE
id=[Evil_Query]
mySQL error: You have an error in your SQL syntax. Check the manual
that corresponds to your MySQL server version for the right syntax to
use near '[Evil_Query]' at line 1
mySQL error code:
Date: Sunday 21st of March 2004 11:28:18 AM
-----[ /Ends Error ]---------------------------------------------
As we can see from this it would be of little difficulty for any
attacker to execute arbitrary requests. For example pulling the
admin hash and/or possibly taking admin control over an affected
Invision Gallery or Invision Power Board installation. Here are
some example urls that could be exploited by an attacker.
index.php?act=module&module;=gallery&cmd;=si&img;=[SQL]
index.php?act=module&module;=gallery&cmd;=editimg&img;=[SQL]
index.php?act=module&module;=gallery&cmd;=ecard&img;=[SQL]
index.php?act=module&module;=gallery&cmd;=moveimg&img;=[SQL]
index.php?act=module&module;=gallery&cmd;=delimg&img;=[SQL]
index.php?act=module&module;=gallery&cmd;=post&cat;=[SQL]
index.php?act=module&module;=gallery&cmd;=sc&op;=user&sort;_key=[SQL]
index.php?act=module&module;=gallery&cmd;=sc&op;=user&sort;_key=dateℴ_key=[SQL]
index.php?act=module&module;=gallery&cmd;=favs&op;=add&img;=[SQL]
index.php?act=module&module;=gallery&cmd;=slideshow&cat;=[SQL]
index.php?act=module&module;=gallery&cmd;=user&user;=[SQL]&op;=view_album&album;=1
index.php?act=module&module;=gallery&cmd;=user&user;=[SQL]
index.php?act=module&module;=gallery&cmd;=user&user;=1&op;=view_album&album;=[SQL]
Some of these are easier to exploit than others obviously, but the
large number of SQL Injection possibilities definitely makes it that
much easier for an attacker to get results from these issues.
|
GulfTech Computers - Professional Computer Services 
