Security Advisory: SQL injection in PhpWebSite <= 0.10.1

[Kevin Wilcox <kevin () tux appstate edu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

========================================================================
phpWebSite Security Advisory        phpwebsite_security () tux appstate edu
http://phpwebsite.appstate.edu                              Kevin Wilcox
12 October 2005
========================================================================

Type:              SQL Injection
Versions Affected: <= 0.10.1

Description:
phpWebSite is an open source Content Management System released by
Electronic Student Services at Appalachian State University.

At 930 EST the phpWebSite development team was made aware that, using a
flaw in the Search module, an attacker was able to gain access to
approximately ten user names and hashed passwords using URLs formatted
in the following fashion:

http://SITE_NAME/index.php?module='+UNION+select+username,username+from+mod_users+where+user_id='1'/*
http://SITE_NAME/index.php?module='+UNION+select+username,password+from+mod_users+where+user_id='1'/*

Only versions 0.10.1 and earlier are affected. The current stable
release, 0.10.2, and the latest development release, fallout, are not
susceptible.

Patch Status:
A patch was released approximately 90 minutes after the development team
was made aware of the flaw. The patch is available from sourceforge:

http://osdn.dl.sourceforge.net/sourceforge/phpwebsite/phpwebsite_security_patch_20051202.tgz

and on the phpwebsite main page:

http://phpwebsite.appstate.edu


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFDTV2I7XWNuvsOTiYRApfTAKCY1mFj3M5aJeQfsInfZsaUlL1mbwCfUJ+T
0p6mgP5bN7fqnahc08CFDI4=
=NNaS
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/