tag:blogger.com,1999:blog-336720282009-02-21T11:10:10.495+08:00Research and DevelopmentSecaware Researchnoreply@blogger.comBlogger2125tag:blogger.com,1999:blog-33672028.post-1157485440843830372006-09-06T03:38:00.000+08:002006-09-06T04:14:21.656+08:00About:<br /><br />Timesheet.php is a PHP application designed to keep track of<br />the hours worked by multiple people on multiple projects. It<br />allows users to log in through their web browser and manage<br />the times that they are clocked on or clocked off.<br /><br />Description:<br /><br />A vulnerability can be found on the file login.php on<br />$_POST['username'] variable. When magic_quotes_gpc is set to Off<br />an intruder can trigger a blind sql injection.<br /><br />Escalation:<br /><br />1. Disclosure of administrator username and password<br /> hash (MD5, PASSWORD) credentials.<br />2. Remote code execution in case the intruder knows where<br /> to save the output of the sql injection on the local path.<br /><br />Solution:<br /><br />Create addslashes function that will filter the $_POST and<br />$_GET variables.<br /><br />Vendor:<br /><br />http://sourceforge.net/projects/tsheet<br />dwayner79 at users.sourceforge.net<br />vexil at users.sourceforge.net<br /><br />Time table:<br /><br />Notified: 09/04/2006<br />Response: No Response<br />Public disclosure: 09/05/2006<br />Updates: N/A<br /><br />Credits:<br /><br />Research By: Secaware Research<br />Research Site: http://secaware.blogspot.com<br />Research Mail: secaware2006 at yahoo dot com<br /><br />References:<br /><br />http://secaware.blogspot.com/2006/09/timesheet-121-blind-sql-injection.html<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/33672028-115748544084383037?l=secaware.blogspot.com'/></div>Secaware Researchnoreply@blogger.comtag:blogger.com,1999:blog-33672028.post-1157070237303875062006-09-01T08:11:00.000+08:002006-09-06T03:52:37.123+08:00Web Application Vulnerabilities are the following:<br /><br />1. Arbitrary Local File Inclusion Vulnerability<br />2. Arbitrary Local File Retrieval Vulnerability<br />3. Remote File Inclusion Vulnerability<br />4. Remote Code Execution Vulnerability<br />5. Remote SQL Injection Vulnerability<br />6. Remote Blind SQL Injection Vulnerability<br />7. XSS Cross-site Scripting Vulnerability<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/33672028-115707023730387506?l=secaware.blogspot.com'/></div>Secaware Researchnoreply@blogger.com