Onderwerp: TYPO3 SQL Injection vunerabilitie

Hello Bugtraq
Two week ago I found a SQL Inejetion vulnerabilitie in Typo3 (in the links-section/module/whatever you call it).
I didn't really try to develope an exploit because I thought typo3 would directly react.
But unfortunately that didn't happen :/

So here is the url that "exploits" the vulnerabilitie in a friendly way

http://[UrlToLinksSection]?&no_cache=1&action=getviewcategory&category_uid=1 %20or%201=1

Maybe someone will find a way to exploit this one in a maliceous way so get typo3 to update it's software!

C ya
Neonomicus

Greets go out to:
Visus, Data-Storm-Industries-crew, Feanor, juck, the orkut-community , everybody I forgot ^^

Visit me at http://data-storm.com

In-Reply-To: <20050303170830.16705.qmail@www.securityfocus.com>

Hi:

>
>http://[UrlToLinksSection]?&no_cache=1&action=getviewcategory&category_uid=1 %20or%201=1
>

What do you mean by [UrlToLinksSection]? I work with Typo3 almost every day and don't see what you are refering to.

Thanks,
Dennis

--nextPart1255439.XLmqtBBgPF
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi Dennis,

I am pretty sure Fabian (Neonomicus) meant *every link* (or site) generated=
by=20
Typo3, didn't he? For instance if you search google for=20
"inurl:action=3Dgetviewcategory" I am pretty sure you will understand what =
he=20
meant (or am I wrong here)?

@Fabian (Neonomicus): Could you please provide more details about the=20
vulnerability you've discoveredl? By the way did you give the Typo3 guys=20
*enough* time to respond???

All the best,
Sebastian

--nextPart1255439.XLmqtBBgPF
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQBCJ5iGd8QFWG1Rza8RAo8YAJ9uAoaf9O+8huGFPJA5VF K3ftHuzgCgrqLS
u6K2unHJy7zCVRWHKs/kkfE=
=dOmK
-----END PGP SIGNATURE-----

--nextPart1255439.XLmqtBBgPF--

Here is a POC for the typo3 issue to test if you are vulnerable. This
doesn't pull the password, just the username

http://path/?&action=getviewcategory...20SELECT%20use
rname%20FROM%20be_users%20WHERE%20uid=1/*

Also, it's easy to pull lists of data from the database using this
vulnerability since the query results are looped and displayed. Take the
following example. It would list usernames as categories

http://path/?&action=getviewcategory...20SELECT%20use
rname,null%20FROM%20be_users%20WHERE%201/*

James

-----Original Message-----
From: Sebastian Wolfgarten [mailto:sebastian@wolfgarten.com]
Sent: Thursday, March 03, 2005 5:07 PM
To: bugtraq@securityfocus.com
Subject: Re: TYPO3 SQL Injection vunerabilitie

Hi Dennis,

I am pretty sure Fabian (Neonomicus) meant *every link* (or site) generated
by
Typo3, didn't he? For instance if you search google for
"inurl:action=getviewcategory" I am pretty sure you will understand what he
meant (or am I wrong here)?

@Fabian (Neonomicus): Could you please provide more details about the
vulnerability you've discoveredl? By the way did you give the Typo3 guys
*enough* time to respond???

All the best,
Sebastian

--
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 266.5.5 - Release Date: 3/1/2005



--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 266.5.5 - Release Date: 3/1/2005

--3VRmKSg17yJg2MZg
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Mar 04, 2005 at 12:06:37AM +0100, Sebastian Wolfgarten wrote:
> I am pretty sure Fabian (Neonomicus) meant *every link* (or
> site) generated by Typo3, didn't he?

Even if he did, it would be just as incorrect as the original
Subject.

> @Fabian (Neonomicus): Could you please provide more details
> about the vulnerability you've discoveredl? By the way did you
> give the Typo3 guys *enough* time to respond???

Most likely it was some weird way of contacting them in the
first place: posting the message to BTS resulted in an updated
extension version being published within some 5 hours, security
announce on the website ("Severity: high") and a reminder on
contact address (typo3-project-security>lists.netfielders.de).

PS: when choosing "the next CMS", one of our considerations was
virtually empty bugtraq coverage (with the code being public
since 2000 and used on quite a few sites). Go figure :-)

--=20
---- WBR, Michael Shigorin <mike@altlinux.ru>
------ Linux.Kiev http://www.linux.kiev.ua/

--3VRmKSg17yJg2MZg
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFCKJCtbsPDprYMm3IRAs50AJ4se94qmMUcmI4E6vScUn CfNfwwggCaAj/V
ZdnLHkJLeGZWSrDiNEMpkOI=
=HpPl
-----END PGP SIGNATURE-----

--3VRmKSg17yJg2MZg--

In-Reply-To: <20050303170830.16705.qmail@www.securityfocus.com>

Hi.

>Two week ago I found a SQL Inejetion vulnerabilitie in Typo3 (in
the links-section/module/whatever you call it).

This is the first important information - this is NOT a vulnerability
in TYPO3 itself, but in an extension.

>I didn't really try to develope an exploit because I thought typo3
would directly react.
>But unfortunately that didn't happen :/

Who did you contact? When? How? At least the security team was
rather surprised about this. Could you explain this?

Finally: This has been analyzed by now, work is being done to fix
this.

Regards,
Karsten