Bugtraq mailing list archives
Re: Re: [KAPDA::#16] - SMF SQL Injection
From: retrogod () aliceposta it
Date: 10 Dec 2005 20:46:01 -0000
[quote] I'm a developer from over at simplemachines and I do not see how this can pose an exploit? Let's examine the code piece by piece: The code is entered at this point: if (!is_numeric($_REQUEST['start'])) So, will be executed if $_REQUEST['start'] is a string. It's then used in the query. However, it's used in the query in this piece of code: substr(strtolower($_REQUEST['start']), 0, 1) So, the string is set to lower case, and then only the FIRST letter is used within the query. How can anyone exploit the database with a one character insertion? Of course this is within single quotes as well, so it cannot even be a command. I simply cannot see how you could possibly exploit SQL from this? [/quote] mphhh, correct... the only problem I see is path disclosure, 'cause you can inject only a one char string: http://[target]/smfrc1/index.php?action=mlist;sort=realName;start=\;desc query becomes: SELECT COUNT(ID_MEMBER) FROM smf_members WHERE LOWER(SUBSTRING(realName, 1, 1)) < '\' AND is_activated = 1 and at screen, you have: Errore di sintassi nella query SQL vicino a ''\' AND is_activated = 1' linea 3 File: [full_application_path]Memberlist.php Line: 162 but I think you cannot inject commands...
Current thread:
- [KAPDA::#16] - SMF SQL Injection alireza hassani (Dec 09)
- <Possible follow-ups>
- Re: [KAPDA::#16] - SMF SQL Injection grudge (Dec 10)
- Re: [KAPDA::#16] - SMF SQL Injection ascii (Dec 12)
- Re: Re: [KAPDA::#16] - SMF SQL Injection retrogod (Dec 12)
- Re: Re: [KAPDA::#16] - SMF SQL Injection polnby (Dec 12)
- Re: Re: [KAPDA::#16] - SMF SQL Injection Steven M. Christey (Dec 12)
- Re: Re: Re: [KAPDA::#16] - SMF SQL Injection grudge (Dec 14)