imei Addmimistrator’s BugBlog

——————-Summary—————-
Software: Olate Download
Sowtware’s Web Site: http://www.olate.co.uk/
Versions: 3.4.2
Class: Remote
Status: Patched
Exploit: Available
Solution: Not Available
Discovered by: imei addmimistrator
Risk Level: Middel
—————–Description—————
Olate download is prone to SQL injection in download.php file.
Lack of programmer’s knowledge about HTTP headers and process of assigning value to predefined global arrays, resulted to this bug.With a shallow look, on line app. 118-127 you’ll understand that programmers trusted to headers HTTP_REFERER and HTTP_USER_AGENT, unaware that hackers can modify them for his abuse.
code:119,download.php
$dbim->query(’INSERT INTO ‘.DB_PREFIX.’stats
SET file_id = ‘.$_REQUEST[’file’].’,
timestamp = “‘.time().’”,
ip = “‘.$_SERVER[’REMOTE_ADDR’].’”,
referrer = “xx’.$_SERVER[’HTTP_REFERER’].’”,
user_agent = “‘.$_SERVER[’HTTP_USER_AGENT’].’”‘);
————–Exploit———————-
headers:
reffered: ’sql
OR
user agent: ’sql
———–Solution———————
Update to 3.4.3
————–Credit———————–
Discovered by: imei addmimistrator
addmimistrator(4}gmail(O}com
www.myimei.com

Posted by imei on Wednesday, August 22nd, 2007 at 9:28 pm.