Attachment 40359 Details for Bug 14412 – [PASSED QA] Bug 14412 : SQL injection possible

[patch] [PASSED QA] Bug 14412 : SQL injection possible

PASSED-QA-Bug-14412--SQL-injection-possible.patch (text/plain), 1.92 KB, created by Katrin Fischer on 2015-06-19 10:31:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Katrin Fischer

Created: 2015-06-19 10:31:17 UTC

Size: 1.92 KB

patch

obsolete

>From 774a67a0528bb6494db41b2c52c3ae0f1e6ff1a9 Mon Sep 17 00:00:00 2001
>From: Chris Cormack <chrisc@catalyst.net.nz>
>Date: Fri, 19 Jun 2015 08:35:07 +1200
>Subject: [PATCH] [PASSED QA] Bug 14412 : SQL injection possible
>
>There is a SQL Injection vulnerability in the
>/cgi-bin/koha/opac-tags_subject.pl script.
>
>By manipulating the variable 'number', the database can be accessed
>via time-based blind injections.
>
>The following string serves as an example:
>
>/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
>
>To exploit the vulnerability, no authentication is needed
>
>To test
>1/ Turn on mysql query logging
>2/ Hit /cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
>3/ Check the logs notice something like
>  SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
>  PROCEDURE ANALYSE
>  (EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
>4/ Apply patch
>5/ Hit the url again
>6/ Notice the log now only has
>   SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
>
>Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
>Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
>Confirmed the problem and the fix for it.
>---
> opac/opac-tags_subject.pl |    4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/opac/opac-tags_subject.pl b/opac/opac-tags_subject.pl
>index d879d51..590e7a5 100755
>--- a/opac/opac-tags_subject.pl
>+++ b/opac/opac-tags_subject.pl
>@@ -51,8 +51,8 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
> 
> my $number = $query->param('number') || 100;
> 
>-my $sth = $dbh->prepare("SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT $number");
>-$sth->execute;
>+my $sth = $dbh->prepare("SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT ?");
>+$sth->execute($number);
> 
> my %result;
> my $max=0;
>-- 
>1.7.10.4

Actions: View | Diff | Splinter Review

Attachments on bug 14412: 40334 | 40346 | 40359