Mailing List Archive: MODX SQLi from oss-sec

MODX SQLi from oss-sec

Mar 8, 2014, 9:24 AM

Post #1 of 3 (1567 views)

The author of the email to the oss-sec says he isn't sure if the linked
commit fixes the issue and it should.

You can exploit this possibly using a blind time or boolean sqli. This is
me just playing around after doing some code analysis. Possibly other
connectors are affected? No idea about whether authentication will be
needed for all vectors, but in my cursory testing it needed at least a
PHPSESSID cookie (maybe just get first index to get anon PHPSESSID, who
knows).

[2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Error 42000
executing statement:
Array
(
[0] => 42000
[1] => 1064
[2] => You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near
'1=1' at line 1
)

[2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Could not
prepare context: mgr 1=1
[2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
executing statement:
Array
(
[0] => 42S22
[1] => 1054
[2] => Unknown column 'mgr' in 'where clause'
)

[2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Could not
prepare context: mgr and 1=1
[2014-03-08 11:03:54] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
executing statement:
Array
(
[0] => 42S22
[1] => 1054
[2] => Unknown column 'mgr' in 'where clause'
)

--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

Re: MODX SQLi from oss-sec [ In reply to ]

bperry.volatile at gmail

Mar 8, 2014, 9:24 AM

Post #2 of 3 (1486 views)

Permalink

Sorry, oss-sec link:
http://seclists.org/oss-sec/2014/q1/532

On Sat, Mar 8, 2014 at 11:24 AM, Brandon Perry <bperry.volatile@gmail.com>wrote:

> The author of the email to the oss-sec says he isn't sure if the linked
> commit fixes the issue and it should.
>
> You can exploit this possibly using a blind time or boolean sqli. This is
> me just playing around after doing some code analysis. Possibly other
> connectors are affected? No idea about whether authentication will be
> needed for all vectors, but in my cursory testing it needed at least a
> PHPSESSID cookie (maybe just get first index to get anon PHPSESSID, who
> knows).
>
> [2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Error 42000
> executing statement:
> Array
> (
> [0] => 42000
> [1] => 1064
> [2] => You have an error in your SQL syntax; check the manual that
> corresponds to your MySQL server version for the right syntax to use near
> '1=1' at line 1
> )
>
> [2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Could not
> prepare context: mgr 1=1
> [2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
> executing statement:
> Array
> (
> [0] => 42S22
> [1] => 1054
> [2] => Unknown column 'mgr' in 'where clause'
> )
>
> [2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Could not
> prepare context: mgr and 1=1
> [2014-03-08 11:03:54] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
> executing statement:
> Array
> (
> [0] => 42S22
> [1] => 1054
> [2] => Unknown column 'mgr' in 'where clause'
> )
>
>
>
> --
> http://volatile-minds.blogspot.com -- blog
> http://www.volatileminds.net -- website
>

--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

Re: MODX SQLi from oss-sec [ In reply to ]

bperry.volatile at gmail

Mar 8, 2014, 9:59 AM

Post #3 of 3 (1501 views)

Permalink

FWIW I believe it is this line that is vulnerable in particular. I can't
prove this at the moment though:

core/model/modx/processors/resource/getnodes.class.php:134:
"(SELECT COUNT(*) FROM {$this->modx->getTableName('modResource')} WHERE
context_key = modContext.{$this->modx->escape('key')} AND id IN
({$this->defaultRootId})) > 0",

On Sat, Mar 8, 2014 at 11:24 AM, Brandon Perry <bperry.volatile@gmail.com>wrote:

> Sorry, oss-sec link:
> http://seclists.org/oss-sec/2014/q1/532
>
>
> On Sat, Mar 8, 2014 at 11:24 AM, Brandon Perry <bperry.volatile@gmail.com>wrote:
>
>> The author of the email to the oss-sec says he isn't sure if the linked
>> commit fixes the issue and it should.
>>
>> You can exploit this possibly using a blind time or boolean sqli. This is
>> me just playing around after doing some code analysis. Possibly other
>> connectors are affected? No idea about whether authentication will be
>> needed for all vectors, but in my cursory testing it needed at least a
>> PHPSESSID cookie (maybe just get first index to get anon PHPSESSID, who
>> knows).
>>
>> [2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Error 42000
>> executing statement:
>> Array
>> (
>> [0] => 42000
>> [1] => 1064
>> [2] => You have an error in your SQL syntax; check the manual that
>> corresponds to your MySQL server version for the right syntax to use near
>> '1=1' at line 1
>> )
>>
>> [2014-03-08 11:03:33] (ERROR @ /modx/connectors/lang.js.php) Could not
>> prepare context: mgr 1=1
>> [2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
>> executing statement:
>> Array
>> (
>> [0] => 42S22
>> [1] => 1054
>> [2] => Unknown column 'mgr' in 'where clause'
>> )
>>
>> [2014-03-08 11:03:44] (ERROR @ /modx/connectors/lang.js.php) Could not
>> prepare context: mgr and 1=1
>> [2014-03-08 11:03:54] (ERROR @ /modx/connectors/lang.js.php) Error 42S22
>> executing statement:
>> Array
>> (
>> [0] => 42S22
>> [1] => 1054
>> [2] => Unknown column 'mgr' in 'where clause'
>> )
>>
>>
>>
>> --
>> http://volatile-minds.blogspot.com -- blog
>> http://www.volatileminds.net -- website
>>
>
>
>
> --
> http://volatile-minds.blogspot.com -- blog
> http://www.volatileminds.net -- website
>

--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website