|
Description
|
|
High-Tech Bridge has discovered multiple vulnerabilities in ClipBucket, which can be exploited by malicious users and malicious people to conduct SQL injection attacks.
Input passed via multiple parameters to multiple scripts is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
List of affected scripts and parameters:
<a href="http://[host]/user_contacts.php?user
" target="_blank">http://[host]/user_contacts.php?user
</a>
<a href="http://[host]/view_channel.php?user
" target="_blank">http://[host]/view_channel.php?user
</a>
<a href="http://[host]/view_page.php?pid
" target="_blank">http://[host]/view_page.php?pid
</a>
<a href="http://[host]/view_topic.php?tid
" target="_blank">http://[host]/view_topic.php?tid
</a>
<a href="http://[host]/watch_video.php?v
" target="_blank">http://[host]/watch_video.php?v
</a>
<a href="http://[host]/ajax.php?mode=add_friend&uid (POST)
" target="_blank">http://[host]/ajax.php?mode=add_friend&uid (POST)
</a>
<a href="http://[host]/ajax.php?mode=share_object&type=video&id (POST)
" target="_blank">http://[host]/ajax.php?mode=shar...p;type=video&id (POST)
</a>
<a href="http://[host]/ajax.php?mode=share_object&type=photo&id (POST)
" target="_blank">http://[host]/ajax.php?mode=shar...p;type=photo&id (POST)
</a>
<a href="http://[host]/ajax.php?mode=share_object&type=collection&id (POST)
" target="_blank">http://[host]/ajax.php?mode=shar...e=collection&id (POST)
</a>
<a href="http://[host]/ajax.php?mode=flag_object&type=video&id (POST)
" target="_blank">http://[host]/ajax.php?mode=flag...p;type=video&id (POST)
</a>
<a href="http://[host]/ajax.php?mode=flag_object&type=photo&id (POST)
" target="_blank">http://[host]/ajax.php?mode=flag...p;type=photo&id (POST)
</a>
<a href="http://[host]/ajax.php?mode=flag_object&type=collection&id (POST)
" target="_blank">http://[host]/ajax.php?mode=flag...e=collection&id (POST)
</a>
<a href="http://[host]/ajax.php?mode=flag_object&type=user&id (POST)
" target="_blank">http://[host]/ajax.php?mode=flag...mp;type=user&id (POST)
</a>
<a href="http://[host]/ajax.php?mode=load_more_items&type=videos&cid (POST)
" target="_blank">http://[host]/ajax.php?mode=load...type=videos&cid (POST)
</a>
<a href="http://[host]/ajax.php?mode=load_more_items&type=photos&cid (POST)
" target="_blank">http://[host]/ajax.php?mode=load...type=photos&cid (POST)
</a>
The vulnerabilities are confirmed in version 2.6-r738. Prior versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
ClipBucket 2.x
|
|
|
|
|
|
Solution
|
|
Update to version 2.6-r738-security-fixed-p2.
|
|
|
|
|
|
CVE
|
|
CVE-2012-5849
|
|
|
|
|
|
References
|
|
HTB23125:
https://www.htbridge.com/advisory/HTB23125
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
