SQL Injection in WeBid

[High-Tech Bridge Security Research <advisory@xxxxxxxxxxx>]

Advisory ID: HTB23292
Product: WeBid
Vendor: WeBid
Vulnerable Version(s): 1.1.2P2 and probably prior
Tested Version: 1.1.2P2
Advisory Publication:  January 22, 2016  [without technical details]
Vendor Notification: January 22, 2016 
Vendor Patch: February 4, 2016 
Public Disclosure: February 17, 2016 
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High 
CVSSv3 Base Score: 7.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered SQL Injection vulnerability 
in a poplar web auction software WeBid. The vulnerability can be exploited by 
remote non-authenticated attacker to alter present SQL query and execute 
arbitrary SQL commands in application's database. Successful exploitation of 
the vulnerability will allow attacker to read, modify and delete arbitrary 
records in the database of vulnerable web application and gain complete control 
over the website. 

The vulnerability exists due to insufficient filtration of '$_SESSION["id"]' 
session variable. The attacker can alter the original SQL query and execute 
arbitrary SQL commands in application’s database. 

A simple exploit below will modify the SQL query and display version of current 
MySQL server. The exploitation technique consists of two steps. At the first 
step we modify '$_SESSION["id"]' session variable and inject our exploit into 
it:

http://webid/friend.php?id=-1%20UNION%20SELECT%20version()%20--%202

The exploitation actually occurs, when crafted '$_SESSION["id"]' variable is 
used in "/feedback.php" script. After visiting the following page MySQL version 
will be displayed:

http://webid/feedback.php?wid=1&sid=1&ws=w

-----------------------------------------------------------------------------------------------

Solution:

Apply vendor's security patch for WeBid 1.1.2P2

More Information:
http://webidsupport.com/forums/index.php?threads/security-patch-for-1-1-2p2-and-older.9078/

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23292 - 
https://www.htbridge.com/advisory/HTB23292  - SQL Injection in WeBid
[2] WeBid - http://www.webidsupport.com/ - WeBid is the perfect way to get your 
auction site up and away
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by 
High-Tech Bridge for on-demand and continuous web application security, 
vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL 
implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.