by r0t,der4444,cembo,VietMafia

Saturday, November 26, 2005

Post Affiliate Pro 2.0.x Vuln.

Post Affiliate Pro 2.0.x Vuln.
Vuln. dicovered by : r0t
Date: 26 nov. 2005
Vendor:http://www.qualityunit.com/postaffiliatepro/
affected version:2.0.4 and prior



Product description:

Very powerful affiliate software. Free installation with every purchase. Easily set up and maintain your own affiliate program. Support for all types of commissions up to 10-tiers including recurring. Customizable email notifications, mass emails to affiliates. Flexible payout functions, set minimum balance, full payout history. Approve affiliates and sales. Automatic fraud protection. Performance rewards, signup bonus. Multi-language support. Extensive reports and statistics. and much more..




Vuln. Description:

1.
Input passed to the "sortorder" parameter isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.


2.
Input passed to the "md" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.
Successful exploitation requires that "magic_quotes_gpc" is disabled.



examples:

/merchants/index.php?md=[FILE]

/postaffiliatepro/merchants/index.php?tm_userid=_&tm_
orderid=&tm_transtype%5B%5D=32&tm_transtype%5B%5D=1&
tm_transtype%5B%5D=2&tm_transtype%5B%5D=4&tm_transtyp
e%5B%5D=8&tm_transtype%5B%5D=16&tm_transtype%5B%5D=64
&tm_status=_&tm_day1=25&tm_month1=11&tm_year1=2005&tm
_day2=25&tm_month2=11&tm_year2=2005&numrows=20&filter
ed=1&md=[File]

/merchants/index.php?um_name=&um_surname=&um_aid=&um_
status=_&numrows=20&filtered=1&md=[File]

/merchants/index.php?tm_userid=_&tm_orderid=&tm_transt
ype%5B%5D=32&tm_transtype%5B%5D=1&tm_transtype%5B%5D=2
&tm_transtype%5B%5D=4&tm_transtype%5B%5D=8&tm_transtyp
e%5B%5D=16&tm_transtype%5B%5D=64&tm_status=_&tm_day1=2
5&tm_month1=11&tm_year1=2005&tm_day2=25&tm_month2=11&t
m_year2=2005&numrows=20&filtered=1&md=Affiliate_Mercha
nts_Views_TransactionManager&type=all&list_page=0&acti
on=&sortby=ip&sortorder=[SQL]

/merchants/index.php?um_name=&um_surname=&um_aid=&um_s
tatus=_&numrows=20&filtered=1&md=Affiliate_Merchants_V
iews_AffiliateManager&list_page=0&sortby=a.surname&act
ion=&sortorder=[SQL]


Solution:
Edit the source code to ensure that input is properly sanitised.

6 Comments:

Blogger hope told...

Hi ##NAME##, while looking for info on arbitrage sports betting, I saw your blog ##TITLE## and congrats. It's exciting stuff, like the new Sports Arbitrage Software with its five way to make guaranteed winnings. Sports arbitrage, as some may not know, is simply betting on both sides of a sports event - and with this software you should double a same amount bet every 20 days. So, In 12 months a $100 bet wins $1825, and $1,000 wins $18,250. That's a 152% return a month! You don't have to buy our software program for arbitrage unless you think you want the most successful system, and like it's done in only 15 minutes a day. And, unlike a HYIP offer - YOU CAN'T LOSE! Better check this money making ##LINK## for 2006 and be ready start the new year happy and profitable. Get a special deal for affiliates. And good blogging in 2006!

6:05 PM

 
Blogger hope told...

Hi, say while looking for info on arbitrage sports betting, I saw your blog and my congrats to you. It's exciting stuff, like the new Sports Arbitrage Software with its five ways to make you guaranteed winnings. Sports arbitrage in case you don't know is simply betting on both sides of a sports event - and with this software you can double a set bet amount every 20 days! So, In 12 months a $100 bet wins $1825, and $1,000 wins $18,250. That's a potential 152% return a month for this arbitrage sports betting! You don't have to buy our software program for arbitrage sports betting because you could do it manually, but with our software it's done in only 15 minutes a day. And, unlike those HYIP offers - YOU CAN'T be scammed of all your money! Better check this money making http://joetees.tripod.com/sport - for 2006 - and be ready start the new year very profitable. Get a special deal for affiliates - just come see. And good blogging in 2006!

10:43 PM

 
Anonymous annieb told...

This ia a real ##Success## story, ##Financial Freedom ## can be yours,besides ##Good Health ##Pay plan ## can be your as well as##Nutraburst## your favourite drink on your shelf##shelf##Success##http://www.715106253.3tobefree.comWell Done####

2:45 AM

 
Blogger Scott A. Edwards told...

Congradulations on your blog! NOW, check this out, You can join a program that starts at only $7 then the costs go down. Down, Down, Down. It only takes 5 minutes to set up your international account!

To find out more visit: best mlm site. It successfully exposes FREE information and covers best mlm related stuff.

2:00 PM

 
Blogger Scott A. Edwards told...

Congradulations on your blog! NOW, check this out, You can join a program that starts at only $7 then the costs go down. Down, Down, Down. It only takes 5 minutes to set up your international account!

To find out more visit: website site. It successfully exposes FREE information and covers website related stuff.

3:45 AM

 
Anonymous Affiliate programs told...

http://www.online-money-making-opportunities.com

12:00 PM

 

Post a Comment

<< Home

 
Copyright (c) 2006 Pridels Sec Crew