Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2013-10-19 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

.QA (Qatar) TLD Compromised

Published: 2013-10-19
Last Updated: 2013-10-19 17:05:00 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)

According to twitter and messages we received directly, it appears that the .QA (Qatar) TLD was compromised last night by the Syrian Electronic Army. Affected domains appear to be returning back to normal at this point.

Google still returns some results for the compromissed pages, including it's own .qa site:

Links to twitter messages about the compromisse (follow at your own risk) : hxxp://twitter.com/Pr0udSyrian/status/391525943035969536/photo/1

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords:
0 comment(s)

Yet Another WHMCS SQL Injection Exploit

Published: 2013-10-19
Last Updated: 2013-10-19 15:39:26 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)

Update: A patch was released last night. See http://blog.whmcs.com/?t=80223

 

WHMCS, a popular billing/support/customer management system, is still suffering from critical SQL injection issues. Today, yet another vulnerability, including exploit was released. 

Due to the fact that there is no patch available at this point, I will refrain from linking to any exploit details, but it is pretty trivial to find the respective blog post which includes a script to exploit the vulnerability. WHMCS acknowledged the problem [1]

The root cause of this problem, as well as prior problems with the software, appears to be a lack in understanding of proper controls to prevent SQL injection. Good input validation is just a start, but prepared statements are a must. Instead, the WHMCS developers used a rather complex (and buggy) function to escape user input and assemble dynamic SQL queries.

The bug is in a function used throughout WHMCS, so the exploit is not limited to a particular URL.

[1] http://blog.whmcs.com/?t=80206

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords: SQL Injection WHMCS
0 comment(s)
Diary Archives