SQL Injection in TestLink

[High-Tech Bridge Security Research <advisory@xxxxxxxxxxx>]

Advisory ID: HTB23288
Product: TestLink
Vendor: TestLink Development Team
Vulnerable Version(s): 1.9.14 and probably prior
Tested Version: 1.9.14
Advisory Publication:  January 7, 2016  [without technical details]
Vendor Notification: January 7, 2016 
Vendor Patch: January 9, 2016 
Public Disclosure: February 17, 2016 
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High 
CVSSv3 Base Score: 7.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered high-risk SQL injection 
vulnerability in TestLink Open Source Test Management. The vulnerability can be 
exploited to alter the present SQL query and gain access to potentially 
sensitive information or even to completely compromise the vulnerable web 
application.

The vulnerability is caused by insufficient filtration of "apikey" HTTP GET 
parameter, passed to "lnl.php" PHP script. A remote unauthenticated attacker 
can inject and execute arbitrary SQL commands in application's database.

A simple exploit code below will display version of used MySQL server:

http://[host]/lnl.php?apikey=1239999999%27%20OR%201=%28IF%28MID%28version%28%29,1,1%29%20LIKE%205,%201,0%29%29%20--%202


-----------------------------------------------------------------------------------------------

Solution:

Update to TestLink 1.9.15

More Information:
http://mantis.testlink.org/view.php?id=7402

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23288 - 
https://www.htbridge.com/advisory/HTB23288 - SQL Injection in TestLink
[2] TestLink - http://testlink.org/ - TestLink Open Source Test Management
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by 
High-Tech Bridge for on-demand and continuous web application security, 
vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL 
implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.