| शीर्षक | Demokratian SQL Injection and unauthorized admin creation after installalation |
|---|
| विवरण | - Software information:
* Name: Demokratian
* Description: Web application to vote with multiple options easily.
* Reposiroty: https://bitbucket.org/csalgadow/demokratian_votaciones
* Web: http://demokratian.org/
1- SQL Injection
URL: basicos_php/genera_select.php
Parameter: id_provincia
Method: GET
authentication: Not required.
mode: Remote
POC: http://example.com/basicos_php/genera_select.php?id_provincia=-1%20union%20all%20select%201,2,3,4,database()
Patch: https://bitbucket.org/csalgadow/demokratian_votaciones/commits/b56c48b519fc52efa65404c312ea9bbde320e3fa
As we can see the vulnerability is high. You can download the information of the voters. The vulnerability can be patched in this file basicos_php/genera_select.php with this code:
#$id_provincia = fn_filtro($con, $_GET['id_provincia']);
$id_provincia = fn_filtro_numerico($con, $_GET['id_provincia']);
2- Broken Authentication
URL: install/install3.php
POC: http://example.com/install/install3.php
authentication: Not required.
mode: Remote
Parche: https://bitbucket.org/csalgadow/demokratian_votaciones/commits/0d073ee461edd5f42528d41e00bf0a7b22e86bb3
In this file you can add admin user without authorization and without warn to admins.
|
|---|
| स्रोत | ⚠️ https://alquimistadesistemas.com/sql-injection-y-archivo-peligroso-en-demokratian |
|---|
| उपयोगकर्ता | jbenages (UID 1784) |
|---|
| सबमिशन | 05/05/2020 11:01 PM (6 साल पहले) |
|---|
| संयम | 10/08/2020 11:29 AM (3 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 159434 [Demokratian genera_select.php id_provincia SQL इंजेक्शन] |
|---|
| अंक | 17 |
|---|