: Vulnerability ID: HTB22770
: Reference: http://www.htbridge.ch/advisory/sql_injection_in_phpmysport.html

: Vulnerability Details:

: The vulnerability exists due to failure in the "/index.php" script to
: properly sanitize user-supplied input in "v1" variable. Attacker can
: alter queries to the application SQL database, execute arbitrary queries
: to the database, compromise the application, access or modify sensitive
: data, or exploit various vulnerabilities in the underlying SQL database.
:
: http://[host]/index.php?r=news&v1=123%27%20union%20select%201,2,3,4,5,6,
@@version,8,9,10,11,12,13,14,15,16,17%20--%201

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-1109

Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4,
when magic_quotes_gpc is disabled, allow remote attackers to execute
arbitrary SQL commands via the [..] (2) v1 parameter in a news action,
[..]

1. You kids can't seem to search a VDB before posting. This was disclosed
2009-03-12 and assigned CVE-2010-1109.

2. As usual, you leave of important technical details such as the
requirement of magic_quotes_gpc to be disabled.

3. Predictably, other advisories fall under this. Splitting
advisories out like this doesn't fool anyone you know..

http://www.htbridge.ch/advisory/sql_injection_in_phpmysport_1.html
http://www.htbridge.ch/advisory/sql_injection_in_phpmysport_2.html

Both of these are also covered under CVE-2010-1109.

[ reply ]