ezDatabase vuln.

ezDatabase vuln.

Vuln. dicovered by : r0t
Date: 14 dec. 2005
vendor:http://www.ezdatabase.org/
affected version:2.1.2 and prior

Product Description:

A web based program for creating online databases, written in PHP and MySQL. An Admin CP allows you to create databases, fields, categories, users, user groups and customize your databases using powerful templates + settings. Visitors can access your databases via the Visitor File. Export a database, create search forms, view database statistics, approve visitor uploads, implement user registration, use language files, and add built-in extras to your databases such a comments, ratings, and automatic file download logging. 30 day money back guarantee.

Vuln. Description:

1. Input passed to the "p" parameter isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

2.Input passed to the "db_id" parameter isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

3.Input passed to the "cat_id" parameter isn't properly sanitised beforereturn to user. This can be exploited to
get full instalisations path.


examples:

Local file include.

/index.php?p=../Local file

SQL injection.

/index.php?p=getcat&db_id=[SQL]

Directory Travesal

/index.php?p=getcat&db_id=1&cat_id=[CODE]



Solution:
Edit the source code to ensure that input is properly sanitised.