BugTracker.net 3.4.3 SQL Injection

2010-08-3000:00:00

vulners.com

JSON

Name BugTracker.NET
Vendor http://www.ifdefined.com/www/
Versions Affected < 3.4.4 (when custom fields are used)

Author Mark van Tilburg
Website http://markvt.info
Contact markvantilburg [at] gmail [dot] com
Date 2010-08-22

X. INDEX

I. ABOUT THE APPLICATION
II. DESCRIPTION
III. ANALYSIS
IV. SAMPLE CODE
V. FIX
VI. Dates

I. ABOUT THE APPLICATION

A web-based bug or issue tracker written using ASP.NET,
C#, and SQL Server (SQL Server Express too).
Probably has all the features you need. Easy to setup.
Power and flexibility when you need it. Learn more at
http://ifdefined.com/bugtrackernet.html

II. DESCRIPTION

A parameter is not properly sanitised before being
used in SQL queries.

If no custom fields are used this vulnerability
cannot be misused.

III. ANALYSIS

Summary:

A) SQL Injection

The application allows the use of Custom Fields, searching
of these custom fields is possible on the search page.
The value used for searching the custom field is not
properly cleaned before being used in the SQL query.

Please note this vulnerability is in the code lot for a long time
if using BugTracker.NET publicly you could be vulnerable.

IV. SAMPLE CODE

Use ' in the search box of a custom field

V. FIX

A) Don't use custom fields

B) Upgrade to v3.4.4 (http://sourceforge.net/projects/btnet/files/)

C) Or do the fix manually by following the steps at:
http://btnet.svn.sourceforge.net/viewvc/btnet/www/search.aspx?r1=559&r2=566

VI. DATES

Reported to author: 2010-08-20
Acknowledge by author: 2010-08-20
Fixed by author: 2010-08-22

JSON