Description:
Invision Power Top Site List is a flexible site ranking script written in PHP, the
popular programming choice for web developers. Featuring an impressive feature set
with a user-friendly interface your community will feel at home using the system.
SQL Injection Vulnerability:
Invision Power Top Site List is prone to an SQL Injection vuln in its "comment"
feature. This issue is very much exploitable as the injection happens right in
the middle of a WHERE statement. Lets have a look at an example error message to
get a better idea of what is going on.
Error: Error executing query
The software returned the following error:
You have an error in your SQL syntax. Check the manual that
corresponds to your MySQL server version for the right syntax
to use near '[ Evil_Query ]' at line 1
Query Executed: SELECT * FROM tsl_sites WHERE id = [Evil_Query]
As we can see from this it would be of little difficulty for any attacker to execute
arbitrary requests. For example pulling the admin hash and/or possibly taking admin
control over an affected Invision Power Top Site List. Below is an example url to show
how the issue could be exploited.
index.php?act=comments&id;=[Evil_Query]
Solution:
The Invision Power Services team were contacted immediately and hopefully a fix will
be available soon since this is an application that cost users money to use.
Credits:
James Bercegay of the GulfTech Security Research Team.
|
