[Full-disclosure] OrderSys <= 1.6.4 Sql Injection Vulnerabilities

[muuratsalo experimental hack lab <muuratsalo@xxxxxxxxx>]

Dear All,
I have found multiple sql injection vulnerabilities in OrderSys <= 1.6.4.
The vendor knows the vulnerabilities and he is fixing them as stated
in the enclosed advisory. (See also
http://www.bioinformatics.org/phplabware/labwiki/index.php?page=release_notes)
Since the developer is currently patching the current release it is
possible that you can find in the software link different versions of
the same app (1.6.4).
Best,
muuratsalo

            
------------------------------------------------------------------------
            OrderSys <= 1.6.4 Sql Injection Vulnerabilities
            
------------------------------------------------------------------------
     
            author............: muuratsalo (Revshell.com)
            contact...........: muuratsalo[at]gmail[dot]com
            download..........: 
http://www.bioinformatics.org/phplabware/labwiki/index.php
    
     
            [0x01] Vulnerability overview:

            All versions of OrderSys <= 1.6.4 are affected by Sql injection 
vulnerabilities.
            A valid account could be required to exploit the vulnerabilities.
     
            [0x02] Disclosure timeline:
     
            [04/11/2011] - Multiple sql injection vulnerabilities discovered 
and reported to the vendor
            [05/11/2011] - Multiple sql injection vulnerabilities fixed, 
OrderSys 1.6.4 released. 
            [05/11/2011] - OrderSys 1.6.4 is still vulnerable to some sql 
injection vulnerabilities.
            [05/11/2011] - The vendor is currently working on fixing the 
reported issues.
            [06/11/2011] - Public disclosure

            [0x03] Proof of Concept:
              
            
http://localhost/ordersys/ordering/interface_creator/index.php?table_name=vendor&function=search&where_clause=[SQL
 INJECTION]&page=0&order=Address&order_type=ASC
            
http://localhost/ordersys/ordering/interface_creator/index_long.php?table_name=vendor&function=search&where_clause=[SQL
 INJECTION]&page=0&order=Address&order_type=ASC
            
http://localhost/ordersys/ordering/interface_creator/index_short.php?table_name=vendor&function=search&where_clause=[SQL
 INJECTION]&page=0&order=Address&order_type=ASC


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/