AOH :: HP Unsorted W :: C07-2022.HTM

Website Baker Version 2.6.5 and before SQL Injection by Cookie Poisoning



SQL Injection by using Cookie Poisoning for Website Baker Version 2.6.5 and before
SQL Injection by using Cookie Poisoning for Website Baker Version 2.6.5 and before



Website Baker Version 2.6.5 and before contains a SQL injection.
This can be exploited by using Cookie Poisoning

Manufacturer was notified, but want to ignore the request pending release version 3.0

Poison the cookie for the login page with the REMEMBER_KEY variable with a standard sql injection (';  --)

Failing function is in class.login.php 
      // Function to check if a user has been remembered
      function is_remembered() {
            if(isset($_COOKIE['REMEMBER_KEY']) AND $_COOKIE['REMEMBER_KEY'] != '') {
                  // Check if the remember key is correct
                  $database = new database();
                  $check_query = $database->query("SELECT user_id FROM ".$this->USERS_TABLE." WHERE remember_key = '".$_COOKIE['REMEMBER_KEY']."' LIMIT 1");

This function is called by the login screen, hence the vulnerability.
When changing the user table... Free admin login :P

HotFix: 
Change $database->query("SELECT user_id FROM ".$this->USERS_TABLE." WHERE remember_key = '".$_COOKIE['REMEMBER_KEY']."' LIMIT 1"); 
into 
$database->query("SELECT user_id FROM ".$this->USERS_TABLE." WHERE remember_key = '".addslashes($_COOKIE['REMEMBER_KEY'])."' LIMIT 1");

$query_details = $database->query("SELECT * FROM ".$this->USERS_TABLE." WHERE user_id = '".substr($_COOKIE['REMEMBER_KEY'], 0, 11)."' LIMIT 1"); 
into
$query_details = $database->query("SELECT * FROM ".$this->USERS_TABLE." WHERE user_id = '".substr(addslashes($_COOKIE['REMEMBER_KEY']), 0, 11)."' LIMIT 1"); 

With Regards

Rolf Huisman



The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.