Re: possible SQL command injection problem

On Dec 23, 2003, at 04:18, Moritz Bunkus wrote:

> I'm using Anthill 0.2.3 for my two video related projects ogmtools and
> mkvtoolnix at http://www.bunkus.org/ (in case anyone is interested ;).

Glad to hear it!

> Yesterday someone tried to use Anthill as a means of accessing my 
> server
> by injecting PHP code into bug reports and attachments. He created an
> account for himself and started creating bug reports. First he inserted
> a simple '<? passthru("/bin/ls")?>', but that did not work of course -
> the text is used as-is and not interpreted. Believe me, I'm VERY happy
> that HTML code is not allowed! Then he tried something similar by
> creating an attachment with this contents. Still no problem.

Security is one of the primary concerns of Anthill, which is why a 
number of these steps are taken to sanitize user input.

> But the next step does pose a problem. He created an attachment with
> '.php' as the extension and put '<? passthru("$cmd")?>' into it. I
> thought that this code is maybe executed by
> viewing this attachment (just klicking on the link), so I tried
> something the 'attacker' did not think of according to the logs:
> http://www.bunkus.org/anthill/showattachment.php?id=8?cmd=ls
>
> This yiels the following response:
>
> Database error: Invalid SQL: SELECT * FROM attachidx WHERE atid =
> 8?cmd=ls
> MySQL Error: 1064 (You have an error in your SQL syntax. Check the
> manual that corresponds to your MySQL server version for the right
> syntax to use near '?cmd=ls' at line 1)
> Session halted.
>
> I'm no expert for SQL (I know enough to get by and write my own movie
> database, but that's about all) so I can't say how serious this flaw
> is, but I have a pretty bad feeling about it.
>
> Until this is resolved I've password protected my Anthill
> installation.

You can resolve this by upgrading to the latest stable version, 0.2.6.  
The attachment handling has undergone some changes and it's pretty much 
impossible from what I can see for this to happen.  The same code is 
used in 0.3.0 (CVS) so it won't be a concern for 0.3.0.

At any rate, if you go to the demo and look at bug #352 I've done what 
this person did, so you can see for yourself how it's ineffective.

http://anthill.vmlinuz.ca/demo/query.php?bug=352

PHP is not at all executed anymore.... 0.2.3 is fairly old and used the 
old way to handle attachments, so that could very well have been 
missed.

I strongly encourage you to upgrade (and add your site to the links 
section on the main website as well, if you don't mind!)

> Anyway, merry christmas to you all :)

Merry Christmas!

---
MandrakeSoft Security; http://www.mandrakesecure.net/
Online Security Resource Book; http://linsec.ca/
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FE6F2AFD : 88D8 0D23 8D4B 3407 5BD7  66F9 2043 D0E5 FE6F 2AFD}

_______________________________________________
Anthill-workers mailing list
Anthill-workers-+mQDA36h6dWw5LPnMra/[email protected]
http://vmlinuz.ca/mailman/listinfo/anthill-workers