Waraxe IT Security Portal

zer0-c00l · Advanced user

I'm trying to discover some vulnerabilities in Roundcube Webmail, but i'm not good in search holes in php files Embarassed

Searching in the PHPs, i found these lines, which seems intersting:

0262 $result = @odbc_exec($this->connection, $query);
0738 $id = @odbc_exec($this->connection, "SELECT * FROM $result");

0327 $result = @pg_exec($this->connection, 'begin;');
0334 $result = @pg_exec($this->connection, $query);
0611 $result = @pg_exec($this->connection, 'end;');
0631 $result = @pg_exec($this->connection, 'abort;');
0896 $id = @pg_exec($this->connection, "SELECT * FROM $result LIMIT 0");
0978 $result = @pg_exec($this->connection, "SELECT f.attnotnull, f.atthasdef
0989 $result = @pg_exec($this->connection, "SELECT a.adsrc
1001 $result = @pg_exec($this->connection, "SELECT i.indisunique, i.indisprimary, i.indkey

Can we do something based on this lines?

The Roundcube site is www.roundcube.net
The folder that i found the files with those lines is /program/lib/DB/

thanks

waraxe · Site admin

I downloaded that software and looked @ src code for ~10 minutes. And it seems to be written insecurely, towards to sql injection possibilities.
So hopefully I have more free time later and then will test soft in action and then let's see Smile

zer0-c00l · Advanced user

thanks waraxe Very Happy

btw, where can i find some material to learn about sql injection, to search vulnerabilities in PHP scripts like Roundcube, phpBB..?

Again, thanks for your help Very Happy

pexli · Valuable expert

http://injection.rulezz.ru/

zer0-c00l · Advanced user

Thanks