Rivettracker & lt; = more than 1.03 SQL Injection defects and repair

Title: Multiple SQL injections in rivettracker <= 1.03
Author: Ali Raheem
: Http://www.rivetcode.com/software/rivettracker/
Version: <= 1.03
Test Platform: Linux guruplug-debian 3.1.7 #2 PREEMPT Tue Jan 3 20:19:54
MST 2012 armv5tel GNU/Linux
# Greets: spyware, dividead
RivetTracker is a php base torrent tracker. Though rivettracker is
Largely designed for a trusted user environment it does have 3 levels
Of access. Admin (add & delete torrents), uploader and unauthenticated
(If $ hiddentracker = false). However, vulnerable files such
Torrent_functions.php can always be accessed by anyone since there is
No $ hiddentracker check (epic fail ).
Despite this high level of access few inputs are sanities and lines like this:
$ Query = "SELECT filename FROM". $ prefix. "namemap WHERE info_hash = '"
. $ _ GET ['hash']. "'";
Found in dltorrent. php (which can be accessed by any one if
Hiddentracker is false) is unforgivable.
The only check timed med is to insure $ _ GET ['hash'] is 40 chars long.
We can defeat this simply with padding with 0's if poison null bytes
Are not patched we can force the SQL query to return the filename of
File we want to view and download it.
Path_to_rivettracker/dltorrent. php? Hash = 00000 'Union ALL select' ../config. php \ 0
With the PNB patch on php version> = 5.3.4 (and backports) we still
Have arbitary SQL queries but no config. php. config. php contains
Passwords and usernames for admin, user and mysql database.
Other files have unsanitised inputs such as torrent_functions.php,
Here we have no checks! Further more $ hiddentracker isn' t even
Checked! And anyone has access to this file and can run SQL commands
Via post.
Here's my testbench for torrent_functions.php
Ali @ Ali-PC :~ $ Cat test.htm
<Form action = "http://www.bkjia.com/rivettracker/torrent_functions.php"
Method = "POST">
<Input type = "test" name = "hash" size = "100"/>
<Input type = "submit"/>
</Form>
Depending on the privs of the database user you can raise all kinds
Hell (shell creation and arbitrary code execution .)
Enjoy.