SQL Injection in TestLink

[High-Tech Bridge Security Research <advisory () htbridge ch>]

Advisory ID: HTB23288
Product: TestLink
Vendor: TestLink Development Team
Vulnerable Version(s): 1.9.14 and probably prior
Tested Version: 1.9.14
Advisory Publication:  January 7, 2016  [without technical details]
Vendor Notification: January 7, 2016 
Vendor Patch: January 9, 2016 
Public Disclosure: February 17, 2016 
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High 
CVSSv3 Base Score: 7.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered high-risk SQL injection vulnerability in TestLink Open Source Test 
Management. The vulnerability can be exploited to alter the present SQL query and gain access to potentially sensitive 
information or even to completely compromise the vulnerable web application.

The vulnerability is caused by insufficient filtration of "apikey" HTTP GET parameter, passed to "lnl.php" PHP script. 
A remote unauthenticated attacker can inject and execute arbitrary SQL commands in application's database.

A simple exploit code below will display version of used MySQL server:

http://[host]/lnl.php?apikey=1239999999%27%20OR%201=%28IF%28MID%28version%28%29,1,1%29%20LIKE%205,%201,0%29%29%20--%202


-----------------------------------------------------------------------------------------------

Solution:

Update to TestLink 1.9.15

More Information:
http://mantis.testlink.org/view.php?id=7402

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23288 - https://www.htbridge.com/advisory/HTB23288 - SQL Injection in TestLink
[2] TestLink - http://testlink.org/ - TestLink Open Source Test Management
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE 
is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and 
continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST 
compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details 
of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.