what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Osclass 3.5.9 SQL Injection

Osclass 3.5.9 SQL Injection
Posted Feb 18, 2016
Authored by High-Tech Bridge SA | Site htbridge.com

Osclass version 3.5.9 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | 1873a8e1196208b1b465380f46ad84e72520251b671aaa4c7dd577b9cff925a1

Osclass 3.5.9 SQL Injection

Change Mirror Download
Advisory ID: HTB23287
Product: Osclass
Vendor: https://osclass.org/
Vulnerable Version(s): 3.5.9 and probably prior
Tested Version: 3.5.9
Advisory Publication: December 21, 2015 [without technical details]
Vendor Notification: December 21, 2015
Vendor Patch: January 25, 2016
Public Disclosure: February 17, 2016
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High
CVSSv3 Base Score: 7.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered a high-risk SQL injection vulnerability in Osclass, a popular web-based software for building customized classifieds marketplace. The vulnerability can be exploited to gain access to potentially sensitive information in the application database and even to compromise the entire website.

The vulnerability exists due to insufficient filtration of user-supplied input data passed via the "itemsPerPage" HTTP GET parameter to "/index.php" PHP script. A remote unauthenticated attacker can modify the original SQL query and execute arbitrary SQL commands in application's database.

A simple PoC code below uses a time-based SQL injection technique to demonstrate existence of the vulnerability. The following HTTP request will make page rendering very slow, if MySQL server uses 5th version:

http://[host]/index.php?page=user&action=pub_profile&id=1&itemsPerPage=1%20PROCEDURE%20analyse%28%28select%20extractvalue%28rand%28%29, concat%280x3a, %28IF%28MID%28version%28%29, 1, 1%29%20LIKE%205, %20BENCHMARK%285000000, SHA1%281%29%29, 1%29%29%29%29%29, 1%29

-----------------------------------------------------------------------------------------------

Solution:

Update to Osclass 3.6.0

More Information:
https://blog.osclass.org/2016/01/25/osclass-3-6-0-ready-to-download/

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23287 - https://www.htbridge.com/advisory/HTB23287 - SQL Injection in Osclass
[2] Osclass - https://osclass.org/ - Osclass is a php script that allows you to quickly create and manage your own free classifieds site.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    0 Files
  • 4
    Oct 4th
    0 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close