提交 #899134: SoftNews Media Group DataLife Engine 18.0 SQL Injection

DataLife Engine 18.0 (build 103) is affected by an unauthenticated boolean-based blind SQL injection (CWE-89) in the search module (engine/modules/search.php). The flaw resides in DataLife Engine core code and is reproducible against any default DataLife Engine 18.0 installation (full_search=0), independent of site-specific configuration or data; no valid account or interaction is required.

Affected file: engine/modules/search.php
Affected parameter: story (submitted with all_word_seach=1 and titleonly=2)
Affected versions: 18.0 build 103 confirmed; earlier releases sharing the same strip_data()/all_word_seach code path are expected to be affected.
Authentication: none (public search endpoint, guest access)
Attack vector: remote, HTTP POST to /index.php?do=search

Root cause:
1) The story parameter is processed by the custom strip_data() function (around line 67). strip_data() calls stripslashes() BEFORE re-escaping single quotes via str_replace("'", "\\'"). As a result the input sequence \\' survives as a backslash-escaped backslash followed by an unescaped string terminator, which closes the SQL string literal.
2) On the all_word_seach=1 branch (around lines 488-490), when the site runs the default full_search=0 configuration, the value is used WITHOUT the engine's safesql() (mysqli_real_escape_string) escaping. Only strip_data() guards it.
3) The value is interpolated into the static-page search query (titleonly_where[2] = PREFIX."_static.template LIKE '%{story}%'", around line 691) and executed (around line 774/814). With titleonly=2 the clause has no wrapping parentheses, so a trailing # comments out the remainder of the query.

strip_data() removes the characters ( ) = , . % < > + - * ^ $ & [ ] { } ; : which blocks classic automated tooling (e.g. sqlmap function/subquery payloads). Exploitation is achieved with parenthesis-free CASE WHEN <expr> THEN 1 ELSE 0 END constructs and hex-encoded string comparisons (col LIKE 0x...25), where 0x25 supplies the % wildcard without using the stripped literal.

Proof of concept (POST body to /index.php?do=search):

TRUE (results returned):
do=search&subaction=search&story=%5C%5C%27%20OR%201%20LIKE%201%20%23&all_word_seach=1&titleonly=2&search_start=0

FALSE (no results):
do=search&subaction=search&story=%5C%5C%27%20AND%201%20LIKE%202%20%23&all_word_seach=1&titleonly=2&search_start=0

The differential response (search results shown vs. none) forms a boolean oracle. Data is extracted character by character, e.g. to read the database version:
story = \\' OR CASE WHEN @@version LIKE 0x382E342E3225 THEN 1 ELSE 0 END #
(0x382E342E3225 = '8.4.2%'; TRUE means the version starts with 8.4.2). The same method recovers @@version, CURRENT_USER, @@hostname, @@datadir and arbitrary table/column data (e.g. _static.name, _static.descr).

Impact: full unauthenticated read access to the database (CWE-89) - DBMS version, current user, host/path metadata, and arbitrary table contents (user records, password hashes, configuration).

CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5, High)

Remediation: apply $db->safesql() to story on the all_word_seach=1 branch (as already done on the other branches); do not rely on strip_data() alone for SQL context. Preferably migrate the _static/_post search paths to parameterized/prepared statements.

Vendor status: SoftNews Media Group notified on 2026-07-22 via the official support channel ([email protected]) (coordinated disclosure). Public technical advisory: https://pastebin.com/nkMeTizS

• 来源: ⚠️ https://pastebin.com/nkMeTizS
• 用户: elman99 (UID 100037)
• 提交: 2026-07-21 22時25分 (2 月前)
• 管理: 2026-09-23 15時54分 (2 months later)
• 状态: 已接受
• VulDB条目: 408972 [SoftNews Media Group DataLife Engine 18.0 Search search.php strip_data story SQL注入]
• 积分: 17