Projet

Général

Profil

Actions

Anomalie #250

fermé

Security: SQL Injection in picture.php via param idh_adh affect by versions 0.63, 0.63.1, 0.63.2, 0.63.3, 0.64rc1

Ajouté par sbz sbz il y a presque 12 ans. Mis à jour il y a presque 12 ans.

Statut:
Fermé
Priorité:
Immédiat
Assigné à:
Catégorie:
Core
Version cible:
-
Début:
09/05/2012
Echéance:
% réalisé:

100%

Temps estimé:
Version utilisée:

Description

Hi developers,

I've discovered a SQL injection in Galette software on 0.63 branch version and it's seems not fixed regarding the ChangeLog here [1]. The advisory below:

Affected versions

It seems only versions listed here are vulnerable :

  • 0.63
  • 0.63.1
  • 0.63.2
  • 0.63.3
  • 0.64rc1

Vulnerability

The vulnerability is located in file includes/picture.class.php at L.71-73 (cf. [2])

 ...
         $sql = "SELECT picture,format
                 FROM ".PREFIX_DB."pictures
                 WHERE id_adh=".$id_adh;
 ...

$id_adh is an input controlled by the user in file picture.php and not filtered at line L.35-36 (cf. [3]) :

 ...
 else
           $id_adh = $_GET['id_adh'];
 ...

Exploitation

The queries below allow to inject SQL injection to create a data leak in order to retrieve datas on database and server configuration on a Galette fresh installation

- Leak MySQL Version

/picture.php?id_adh=0+and+1=0+union+select+@@version,null

- Leak tables name on a MySQL 5.x (group_concat is limiting output here)

/picture.php?id_adh=0+and+1=0+union+select+group_concat(table_name,char(10)),null+from+information_schema.tables

I don't want to show too many exploitable queries to avoid the usage by kiddies but it's possible to inject hard queries in order to leak adherents datas.

Impact of the vulnerablity

Galette is a well known adherent web interface used by lots of associations (specially French one), it's possible to look for vulnerable targets using the Google dorks below:

  • inurl:self_adherent.php intitle:"Galette v0.63"
  • inurl:self_adherent.php intitle:Galette

The impact is to create database data leaks exposure on any vulnerable Galette installation.

Mitigation of the vulnerability

Update to 0.7.x version

Discovered by

Sofian Brabez <>

Timeline

  • 09/05/2012: Contact vendor through bug tracker on redmine.ulysses.fr

References

[1] http://galette.tuxfamily.org//documentation/fr/changelog.html
[2] http://svn.gna.org/viewcvs/galette/branches/galette-0-63-bugfix/galette/includes/picture.class.php?revision=826&view=markup
http://git.tuxfamily.org/galette/galette?p=galette/galette.git;a=blob;f=includes/picture.class.php;h=9c4985eeb37369c9b64af6e11e6840645474fb2c;hb=7b4b477b0349f00c7555cbd66870ff6f22831faf#l70
[3] http://svn.gna.org/viewcvs/galette/branches/galette-0-63-bugfix/galette/picture.php?revision=825&view=markup
http://git.tuxfamily.org/galette/galette?p=galette/galette.git;a=blob;f=picture.php;h=8ec80ab9f67b66f2fced141d9512332cf64f334e;hb=7b4b477b0349f00c7555cbd66870ff6f22831faf#l35

Mis à jour par Johan Cwiklinski il y a presque 12 ans

  • Statut changé de Nouveau à In Progress

Mis à jour par Johan Cwiklinski il y a presque 12 ans

  • Description mis à jour (diff)

Mis à jour par Johan Cwiklinski il y a presque 12 ans

  • % réalisé changé de 0 à 90
  • Statut changé de In Progress à Résolu

Fixed in commit 8c13ec159b.

New releases will come very soon.

Mis à jour par Johan Cwiklinski il y a presque 12 ans

  • % réalisé changé de 90 à 100
  • Statut changé de Résolu à Fermé
Actions

Formats disponibles : Atom PDF