SQL Injection by using Cookie Poisoning for Website Baker Version 2.6.5 and before

Advisory Content :

Website Baker Version 2.6.5 and before contains a SQL injection.
This can be exploited by using Cookie Poisoning

Manufacturer was notified, but want to ignore the request pending release
version 3.0

Poison the cookie for the login page with the REMEMBER_KEY variable with a
standard sql injection ('; <Insert Your SQL Statment here> --)

Failing function is in class.login.php
// Function to check if a user has been remembered
function is_remembered() {
if(isset($_COOKIE['REMEMBER_KEY']) AND $_COOKIE['REMEMBER_KEY']
!= '') {
// Check if the remember key is correct
$database = new database();
$check_query = $database->query("SELECT user_id FROM
".$this->USERS_TABLE." WHERE remember_key = '".$_COOKIE['REMEMBER_KEY']."'
LIMIT 1");

This function is called by the login screen, hence the vulnerability.
When changing the user table... Free admin login :P

HotFix:
Change $database->query("SELECT user_id FROM ".$this->USERS_TABLE." WHERE
remember_key = '".$_COOKIE['REMEMBER_KEY']."' LIMIT 1");
into
$database->query("SELECT user_id FROM ".$this->USERS_TABLE." WHERE
remember_key = '".addslashes($_COOKIE['REMEMBER_KEY'])."' LIMIT 1");

$query_details = $database->query("SELECT * FROM ".$this->USERS_TABLE."
WHERE user_id = '".substr($_COOKIE['REMEMBER_KEY'], 0, 11)."' LIMIT 1");
into
$query_details = $database->query("SELECT * FROM ".$this->USERS_TABLE."
WHERE user_id = '".substr(addslashes($_COOKIE['REMEMBER_KEY']), 0, 11)."'
LIMIT 1");

With Regards

Rolf Huisman

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

SQL Injection by using Cookie Poisoning for Website Baker Version 2.6.5 and before