Attachment 40334 Details for Bug 14412 – Bug 14412 : SQL injection possible

[patch] Bug 14412 : SQL injection possible

Bug-14412--SQL-injection-possible.patch (text/plain), 1.73 KB, created by Chris Cormack on 2015-06-18 20:37:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2015-06-18 20:37:59 UTC

Size: 1.73 KB

patch

obsolete

>From 6cb29a88d03a33b51a644d688edb4202fe5bf66d Mon Sep 17 00:00:00 2001
>From: Chris Cormack <chrisc@catalyst.net.nz>
>Date: Fri, 19 Jun 2015 08:35:07 +1200
>Subject: [PATCH] Bug 14412 : SQL injection possible
>
>There is a SQL Injection vulnerability in the
>/cgi-bin/koha/opac-tags_subject.pl script.
>
>By manipulating the variable 'number', the database can be accessed
>via time-based blind injections.
>
>The following string serves as an example:
>
>/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
>
>To exploit the vulnerability, no authentication is needed
>
>To test
>1/ Turn on mysql query logging
>2/ Hit /cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
>3/ Check the logs notice something like
>  SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
>  PROCEDURE ANALYSE
>  (EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
>4/ Apply patch
>5/ Hit the url again
>6/ Notice the log now only has
>   SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
>---
> opac/opac-tags_subject.pl | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/opac/opac-tags_subject.pl b/opac/opac-tags_subject.pl
>index d879d51..590e7a5 100755
>--- a/opac/opac-tags_subject.pl
>+++ b/opac/opac-tags_subject.pl
>@@ -51,8 +51,8 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
> 
> my $number = $query->param('number') || 100;
> 
>-my $sth = $dbh->prepare("SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT $number");
>-$sth->execute;
>+my $sth = $dbh->prepare("SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT ?");
>+$sth->execute($number);
> 
> my %result;
> my $max=0;
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 14412: 40334 | 40346 | 40359