BugTraq
SQL Injection in WeBid Feb 17 2016 03:20PM
High-Tech Bridge Security Research (advisory htbridge ch)
Advisory ID: HTB23292
Product: WeBid
Vendor: WeBid
Vulnerable Version(s): 1.1.2P2 and probably prior
Tested Version: 1.1.2P2
Advisory Publication: January 22, 2016 [without technical details]
Vendor Notification: January 22, 2016
Vendor Patch: February 4, 2016
Public Disclosure: February 17, 2016
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High
CVSSv3 Base Score: 7.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

------------------------------------------------------------------------
-----------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered SQL Injection vulnerability in a poplar web auction software WeBid. The vulnerability can be exploited by remote non-authenticated attacker to alter present SQL query and execute arbitrary SQL commands in application's database. Successful exploitation of the vulnerability will allow attacker to read, modify and delete arbitrary records in the database of vulnerable web application and gain complete control over the website.

The vulnerability exists due to insufficient filtration of '$_SESSION["id"]' session variable. The attacker can alter the original SQL query and execute arbitrary SQL commands in applicationâ??s database.

A simple exploit below will modify the SQL query and display version of current MySQL server. The exploitation technique consists of two steps. At the first step we modify '$_SESSION["id"]' session variable and inject our exploit into it:

http://webid/friend.php?id=-1%20UNION%20SELECT%20version()%20--%202

The exploitation actually occurs, when crafted '$_SESSION["id"]' variable is used in "/feedback.php" script. After visiting the following page MySQL version will be displayed:

http://webid/feedback.php?wid=1&sid=1&ws=w

------------------------------------------------------------------------
-----------------------

Solution:

Apply vendor's security patch for WeBid 1.1.2P2

More Information:
http://webidsupport.com/forums/index.php?threads/security-patch-for-1-1-
2p2-and-older.9078/

------------------------------------------------------------------------
-----------------------

References:

[1] High-Tech Bridge Advisory HTB23292 - https://www.htbridge.com/advisory/HTB23292 - SQL Injection in WeBid
[2] WeBid - http://www.webidsupport.com/ - WeBid is the perfect way to get your auction site up and away
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST compliance. Supports all types of protocols.

------------------------------------------------------------------------
-----------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus