XOOPS video tube plug-in SQL injection and repair

 
Author: knife

Affected Versions: 2.4.4
Official Address: www.discuz.net

Vulnerability Type: SQL Injection

Plug-in: video tube less than 1.85 (only 1.85 tested)

Vulnerability file: reportvideopopup. php

Vid variable Filtering does not strictly produce SQL Injection

 

 

If (isset ($ _ GET [vid]) $ vid = $ _ GET [vid]; // you know

If (isset ($ _ POST [postreport]) $ op = postreport; if (isset ($ _ POST [reportclose]) $ op = reportclose; if (isset ($ _ GET [op]) $ op = $ _ GET [op]; if (isset ($ _ POST [op]) $ op = $ _ POST [op];

Switch ($ op) {case "generateform": $ result = $ xoopsDB-> queryF ("SELECT id, uid, cid, code, title, artist, service FROM ". $ xoopsDB-> prefix ("vp_videos "). "WHERE id = ". $ vid. "");

$ Video = $ xoopsDB-> fetcharray ($ result); POC:

Http://xxx.com/reportvideopopup.php? Op = generateform & vid = [SQL]

Fix: Filter