Vulnerability Note VU#459565

paFileDB fails to properly sanitize "query" parameter in "pafiledb.php"

This SQL injection vulnerability is one of eight vulnerabilities recently discussed in public forums affecting paFileDB. It works whether magic_quotes is on or not. Proof of concept code and simple examples are in circulation specific to this vulnerability. The following report identifies these vulnerabilities:
http://www.gulftech.org/?node=research&article_id=00082-06142005

The default value for the PHP directive register_globals changed from "on" to "off" in PHP 4.2.0. To quote PHP documentation available from http://www.php.net/register_globals/:

"When on, register_globals will inject (poison) your scripts will all sorts of variables, like request variables from HTML forms. This coupled with the fact that PHP doesn't require variable initialization means writing insecure code is that much easier."

Code near the beginning of paFileDB undermines the security benefits of the register_globals default "off" setting. It does so by registering all variables directly into the PHP global address space.

if (!@ini_get('register_globals')) {
extract($_GET);
extract($_POST);
extract($_COOKIE);
extract($_SERVER);
}

This specific vulnerability is the direct result of the above poor coding practice combined with a failure to initialize the "query" variable before use.

II. Impact

Full code review and rewriting to remove the dependency on all passed parameters being in the global address space is also recommended. The current release as downloaded on 21 June, 2005 still contains the code to put all parameters into the global address space (see above).
Workaround
Restrict access to the paFile application to only trusted users. Restricting access can be achieved through network filtering and restricting access to internal users, and/or through web server access control mechanisms.

Systems Affected

http://www.gulftech.org/?node=research&article_id=00082-06142005
http://www.php.net/register_globals/

Credit

James Bercegay of the GulfTech Security Research Team is credited with discovering this vulnerability.

This document was written by Robert Mead.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.