BugTraq
iScripts CyberMatch 1.0 Blind SQL Injection Vulnerability Jul 01 2010 11:50PM
Salvatore Fresta aka Drosophila (drosophilaxxx gmail com)
--
Salvatore Fresta aka Drosophila
http://www.salvatorefresta.net
CWNP444351
iScripts CyberMatch 1.0 Blind SQL Injection Vulnerability

Name iScripts CyberMatch
Vendor http://www.iscripts.com
Versions Affected 1.0

Author Salvatore Fresta aka Drosophila
Website http://www.salvatorefresta.net
Contact salvatorefresta [at] gmail [dot] com
Date 2010-02-07

X. INDEX

I. ABOUT THE APPLICATION
II. DESCRIPTION
III. ANALYSIS
IV. SAMPLE CODE
V. FIX

I. ABOUT THE APPLICATION

iScripts CyberMatch is a turnkey online dating software
for you to start a full-fledged dating site like
match.com or eHarmony in minutes. iScripts CyberMatch can
be used to create your own Dating, Personals or match
making Site, Adult or Matrimonial Site.

II. DESCRIPTION

A parameter is not properly sanitised before being used in
a SQL query.

III. ANALYSIS

Summary:

A) Blind SQL Injection

A) Blind SQL Injection

The id parameter in profile.php is not properly sanitised
before being used in a SQL query. That is not the query
which selects the information about the user specified by
the id parameter but is the query that selects the image's
name. The affected query is a query of five fields.

When the injected condition is true, in the page will be
printed the real link to the personal image of the user
specified by the id parameter, otherwise a link to
bignophoto.gif.

True condition:
http://site/path/images/profiles/id_random.jpg

False condition:
http://site/path/images/profiles/bignophoto.gif

Successful exploitation requires that "magic_quotes_gpc"
is disabled and that the user specified by id parameter
has posted an image.

IV. SAMPLE CODE

A) Blind SQL Injection

http://site/path/profile.php?id=10' UNION SELECT 1,2,3,4,5%23

http://site/path/profile.php?id=10' AND 1=1%23
http://site/path/profile.php?id=10' AND 1=0%23

V. FIX

No Fix.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus