SQL Injection in WeBid

[High-Tech Bridge Security Research <advisory () htbridge ch>]

Advisory ID: HTB23292
Product: WeBid
Vendor: WeBid
Vulnerable Version(s): 1.1.2P2 and probably prior
Tested Version: 1.1.2P2
Advisory Publication:  January 22, 2016  [without technical details]
Vendor Notification: January 22, 2016 
Vendor Patch: February 4, 2016 
Public Disclosure: February 17, 2016 
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High 
CVSSv3 Base Score: 7.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered SQL Injection vulnerability in a poplar web auction software WeBid. 
The vulnerability can be exploited by remote non-authenticated attacker to alter present SQL query and execute 
arbitrary SQL commands in application's database. Successful exploitation of the vulnerability will allow attacker to 
read, modify and delete arbitrary records in the database of vulnerable web application and gain complete control over 
the website. 

The vulnerability exists due to insufficient filtration of '$_SESSION["id"]' session variable. The attacker can alter 
the original SQL query and execute arbitrary SQL commands in application’s database. 

A simple exploit below will modify the SQL query and display version of current MySQL server. The exploitation 
technique consists of two steps. At the first step we modify '$_SESSION["id"]' session variable and inject our exploit 
into it:

http://webid/friend.php?id=-1%20UNION%20SELECT%20version()%20--%202

The exploitation actually occurs, when crafted '$_SESSION["id"]' variable is used in "/feedback.php" script. After 
visiting the following page MySQL version will be displayed:

http://webid/feedback.php?wid=1&sid=1&ws=w

-----------------------------------------------------------------------------------------------

Solution:

Apply vendor's security patch for WeBid 1.1.2P2

More Information:
http://webidsupport.com/forums/index.php?threads/security-patch-for-1-1-2p2-and-older.9078/

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23292 - https://www.htbridge.com/advisory/HTB23292  - SQL Injection in WeBid
[2] WeBid - http://www.webidsupport.com/ - WeBid is the perfect way to get your auction site up and away
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE 
is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and 
continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST 
compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details 
of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.