BibCiter

As published in many places, like this one, BibCiter has been found to have multiple SQL injection vulnerabilities, due to poor treatment of variables passed through URLs (post methods) before being processed.

Here’s some “official” announcement:

BibCiter Multiple SQL Injection Vulnerabilities
SECUNIA ADVISORY ID: SA33555
VERIFY ADVISORY: http://secunia.com/advisories/33555/
CRITICAL: Moderately critical
IMPACT: Manipulation of data
WHERE: >From remote
SOFTWARE: BibCiter 1.x http://secunia.com/advisories/product/21050/
DESCRIPTION: nuclear has discovered some vulnerabilities in BibCiter, which can be exploited by malicious people to conduct SQL injection attacks.
Input passed to the “idp” parameter in reports/projects.php, to the “idc” parameter in reports/contacts.php, and to the “idu” parameter in reports/users.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
These vulnerabilities are confirmed in version 1.4. Other versions may also be affected.
SOLUTION: Edit the source code to ensure that input is properly sanitised.
PROVIDED AND/OR DISCOVERED BY: nuclear
ORIGINAL ADVISORY: http://milw0rm.com/exploits/7814

The solution requires time to code… time that I don’t have in the short run. So, protect yourselves at the .htaccess level.

Here’s how:

• http://www.webproworld.com/internet-security-discussion-forum/71933-latest-injection-attack-declare-set-cast.html#post393209
• http://www.webproworld.com/internet-security-discussion-forum/71933-latest-injection-attack-declare-set-cast.html#post393724

Thanks to Nassim Ettaki and David Alcubierre for valuous help :)

You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.