SQL Injection in WeBid

High-Tech Bridge Security Research Lab discovered SQL Injection vulnerability in a poplar web auction software WeBid. The vulnerability can be exploited by remote non-authenticated attacker to alter present SQL query and execute arbitrary SQL commands in application's database. Successful exploitation of the vulnerability will allow attacker to read, modify and delete arbitrary records in the database of vulnerable web application and gain complete control over the website.

The vulnerability exists due to insufficient filtration of '$_SESSION["id"]' session variable. The attacker can alter the original SQL query and execute arbitrary SQL commands in application’s database.

A simple exploit below will modify the SQL query and display version of current MySQL server. The exploitation technique consists of two steps. At the first step we modify '$_SESSION["id"]' session variable and inject our exploit into it:

http://webid/friend.php?id=-1%20UNION%20SELECT%20version()%20--%202

The exploitation actually occurs, when crafted '$_SESSION["id"]' variable is used in "/feedback.php" script. After visiting the following page MySQL version will be displayed:

http://webid/feedback.php?wid=1&sid=1&ws=w