possible SQL command injection problem

Heya,

I'm using Anthill 0.2.3 for my two video related projects ogmtools and
mkvtoolnix at http://www.bunkus.org/ (in case anyone is interested ;).

Yesterday someone tried to use Anthill as a means of accessing my server
by injecting PHP code into bug reports and attachments. He created an
account for himself and started creating bug reports. First he inserted
a simple '<? passthru("/bin/ls")?>', but that did not work of course -
the text is used as-is and not interpreted. Believe me, I'm VERY happy
that HTML code is not allowed! Then he tried something similar by
creating an attachment with this contents. Still no problem.

But the next step does pose a problem. He created an attachment with
'.php' as the extension and put '<? passthru("$cmd")?>' into it. I
thought that this code is maybe executed by
viewing this attachment (just klicking on the link), so I tried
something the 'attacker' did not think of according to the logs:
http://www.bunkus.org/anthill/showattachment.php?id=8?cmd=ls

This yiels the following response:

Database error: Invalid SQL: SELECT * FROM attachidx WHERE atid =
8?cmd=ls
MySQL Error: 1064 (You have an error in your SQL syntax. Check the
manual that corresponds to your MySQL server version for the right
syntax to use near '?cmd=ls' at line 1)
Session halted.

I'm no expert for SQL (I know enough to get by and write my own movie
database, but that's about all) so I can't say how serious this flaw
is, but I have a pretty bad feeling about it.

Until this is resolved I've password protected my Anthill
installation.

Anyway, merry christmas to you all :)

Mosu

-- 
If Darl McBride was in charge, he'd probably make marriage
unconstitutional too, since clearly it de-emphasizes the commercial
nature of normal human interaction, and probably is a major impediment
to the commercial growth of prostitution. - Linus Torvalds

_______________________________________________
Anthill-workers mailing list
Anthill-workers-+mQDA36h6dWw5LPnMra/[email protected]
http://vmlinuz.ca/mailman/listinfo/anthill-workers

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/6CR7TJ9OsraNuaERAlAsAJwJq2J6/IInAkzaNfhN5c898UaXSACfff1z
d+wR0ZXSFt51/1+mN6jk8qI=
=OHCl
-----END PGP SIGNATURE-----