[41620] in bugtraq
Re: Re: [KAPDA::#16] - SMF SQL Injection
daemon@ATHENA.MIT.EDU (Steven M. Christey)
Mon Dec 12 21:29:45 2005
Date: Sat, 10 Dec 2005 14:36:09 -0500 (EST)
Message-Id: <200512101936.jBAJa9MD029595@cairo.mitre.org>
From: "Steven M. Christey" <coley@mitre.org>
To: bugtraq@securityfocus.com
Cc: trueend5@yahoo.com, grudge@simplemachines.org
>substr(strtolower($_REQUEST['start']), 0, 1)
>
>So, the string is set to lower case, and then only the FIRST letter is
>used within the query. How can anyone exploit the database with a one
>character insertion? Of course this is within single quotes as well,
>so it cannot even be a command.
This sounds like yet another example of a researcher diagnostic error,
which I warned about a couple months ago:
A common researcher diagnosis error: misreading error messages
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2005-10/0040.html
I would bet that the software generated an error based on this portion
of the SQL/PHP code:
WHERE LOWER(SUBSTRING(realName, 1, 1)) < '" .
substr(strtolower($_REQUEST['start']), 0, 1) . "'
The original demonstration value of "start" is:
'[SQL]
and since the first character is "'", PHP would generate something
like:
WHERE LOWER(SUBSTRING(realName, 1, 1)) < '''
which would then generate a syntax error, which could then be
mis-diagnosed as SQL injection.
I bet that many so-called "SQL injection" issues are of this form of
"limited SQL syntax manipulation." It is still an error message
information leak, which some people don't think it security relevant.
But clearly it is much less severe than SQL injection.
- Steve
