bugtraq - Re: Re: [KAPDA::#16]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 10 Dec 2005 20:46:01 -0000
From: retrogod@...ceposta.it
To: bugtraq@...urityfocus.com
Subject: Re: Re: [KAPDA::#16] - SMF SQL Injection

[quote]
I'm a developer from over at simplemachines and I do not see how this can pose an exploit? Let's examine the code piece by piece:

The code is entered at this point:
if (!is_numeric($_REQUEST['start']))

So, will be executed if $_REQUEST['start'] is a string. It's then used in the query. However, it's used in the query in this piece of code:

substr(strtolower($_REQUEST['start']), 0, 1)

So, the string is set to lower case, and then only the FIRST letter is used within the query. How can anyone exploit the database with a one character insertion? Of course this is within single quotes as well, so it cannot even be a command.

I simply cannot see how you could possibly exploit SQL from this?
[/quote]

mphhh, correct...
the only problem I see is path disclosure, 'cause you can inject only a one char string:

http://[target]/smfrc1/index.php?action=mlist;sort=realName;start=\;desc

query becomes:

SELECT COUNT(ID_MEMBER) FROM smf_members WHERE LOWER(SUBSTRING(realName, 1, 1)) < '\' AND is_activated = 1 

and at screen, you have:

Errore di sintassi nella query SQL vicino a ''\'
AND is_activated = 1' linea 3
File: [full_application_path]Memberlist.php
Line: 162 

but I think you cannot inject commands...