[CVE-2012-1002] OpenConf <= 4.11 (author/edit.php) Blind SQL Injection Vulnerability

OpenConf <= 4.11 (author/edit.php) Blind SQL Injection Vulnerability

author…: Egidio Romano aka EgiX
mail…: n0b0d13s[at]gmail[dot]com
software link…: http://www.openconf.com/
affected versions…: from 4.00 to 4.11

[-] Vulnerable code in /author/edit.php:

104.       // get sub
     

105.       $anr = ocsql_query("SELECT * FROM `" . OCC_TABLE_PAPER . "` WHERE `paperid`=" . safeSQLstr($_POST['pid'])) ...
     

106.       if (mysql_num_rows($anr) != 1) {
     

107.               err(oc_('Submission ID or password entered is incorrect'));
     

108.       }
     

109.       $_POST = array_merge($_POST, mysql_fetch_assoc($anr));
     

User input passed through $_POST['pid'] seems correctly sanitised by the safeSQLstr() function, but in the query
at line 105 single quotes aren't used before concatenate the user input into the query string. This can be
exploited to conduct a Blind SQL Injection attack. Successful exploitation of this vulnerability requires at
least a record into the 'paper' table, and 'Edit Submission' to be enabled.

[-] Disclosure timeline:

[27/01/2012] - Vulnerability discovered
[01/02/2012] - Issue reported to bugs(at)openconf.com
[02/02/2012] - Version 4.12 released: http://www.openconf.com/news/#20120202
[02/02/2012] - CVE number requested
[02/02/2012] - Assigned CVE-2012-1002
[02/05/2012] - Public disclosure

[-] Proof of concept:

http://www.exploit-db.com/exploits/18820/