BibCiter

As published in many places, like this one, BibCiter has been found to have multiple SQL injection vulnerabilities, due to poor treatment of variables passed through URLs (post methods) before being processed.

Here’s some “official” announcement:

BibCiter Multiple SQL Injection Vulnerabilities
SECUNIA ADVISORY ID: SA33555
VERIFY ADVISORY: http://secunia.com/advisories/33555/
CRITICAL: Moderately critical
IMPACT: Manipulation of data
WHERE: >From remote
SOFTWARE: BibCiter 1.x http://secunia.com/advisories/product/21050/
DESCRIPTION: nuclear has discovered some vulnerabilities in BibCiter, which can be exploited by malicious people to conduct SQL injection attacks.
Input passed to the “idp” parameter in reports/projects.php, to the “idc” parameter in reports/contacts.php, and to the “idu” parameter in reports/users.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
These vulnerabilities are confirmed in version 1.4. Other versions may also be affected.
SOLUTION: Edit the source code to ensure that input is properly sanitised.
PROVIDED AND/OR DISCOVERED BY: nuclear
ORIGINAL ADVISORY: http://milw0rm.com/exploits/7814

The solution requires time to code… time that I don’t have in the short run. So, protect yourselves at the .htaccess level.

Here’s how:

• http://www.webproworld.com/internet-security-discussion-forum/71933-latest-injection-attack-declare-set-cast.html#post393209
• http://www.webproworld.com/internet-security-discussion-forum/71933-latest-injection-attack-declare-set-cast.html#post393724

Thanks to Nassim Ettaki and David Alcubierre for valuous help :)

BibCiter v1.4 is now out.

Besides some minor issues concerning citing styles, it does fix a critical bug in the autentication process. Detected by Emilio Quintana and solved (thank you!) by Wu Jiewen, the problem was that the lenght of the password field was too short for MySQL 4.1, that needed a longer field to feed in the whole hash value. I wouldn’t have figured ever, so thanks again Jiewen!

Uh, there was a problem with a search filter that made that filter not to work properly (actually, didn’t work at all).

So we fixed it.

And improved some searching routines too.

Download BibCiter v1.3.1

While the whole thing with sessions is solved, the Demo site has been located under bibciter.net instead of bibciter.sourceforge.net. All in all, nobody should notice the difference… besides performance ;)

There are two options:

• BibCiter is terribly coded
• SourceForge hosting does weird things, specially related to sessions

The question is that the Demo site does not work as correctly as it should. I know there are problems with PHP sessions in SourceForge (read something about it when had to install Mediawiki), but I’ll try and fix this anyway.

Any hints on this will be welcome.