Re: SQL Injection in phpMySport

[security curmudgeon <jericho@xxxxxxxxxxxxx>]

: Vulnerability ID: HTB22770
: Reference: http://www.htbridge.ch/advisory/sql_injection_in_phpmysport.html

: Vulnerability Details:

: The vulnerability exists due to failure in the "/index.php" script to 
: properly sanitize user-supplied input in "v1" variable. Attacker can 
: alter queries to the application SQL database, execute arbitrary queries 
: to the database, compromise the application, access or modify sensitive 
: data, or exploit various vulnerabilities in the underlying SQL database.
: 
: 
http://[host]/index.php?r=news&v1=123%27%20union%20select%201,2,3,4,5,6,@@version,8,9,10,11,12,13,14,15,16,17%20--%201

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-1109

Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, 
when magic_quotes_gpc is disabled, allow remote attackers to execute 
arbitrary SQL commands via the [..] (2) v1 parameter in a news action, 
[..]


1. You kids can't seem to search a VDB before posting. This was disclosed 
2009-03-12 and assigned CVE-2010-1109.

2. As usual, you leave of important technical details such as the 
requirement of magic_quotes_gpc to be disabled.

3. Predictably, other advisories fall under this. Splitting 
advisories out like this doesn't fool anyone you know.. 
 
http://www.htbridge.ch/advisory/sql_injection_in_phpmysport_1.html
http://www.htbridge.ch/advisory/sql_injection_in_phpmysport_2.html

Both of these are also covered under CVE-2010-1109.