Secunia

Multiple vulnerabilities have been reported in K-Rate Premium, which can be exploited by malicious users to compromise a vulnerable system and by malicious people and users to conduct script insertion and SQL injection attacks.

1) Input passed to the "show" parameter (when "req" is set to "online") and "id" and "image" (when "act" is set to "vote") in index.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed to the "id" parameter in index.php (when "req" is set to "blog_edit") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of this vulnerability allows e.g. retrieval of administrator usernames and password hashes, but requires valid user credentials and knowledge of the database table prefix.

3) Input passed to the "Your Message" form field in "Forums: Post A New Thread" is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed.

4) Input passed to the "Title" and "Text" form fields in "Blog: Post A New Entry" and "Description" in "Your Pictures" is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed.

Successful exploitation of this vulnerability requires valid user credentials.

5) Input passed as template data to "Manage Templates" is not properly sanitised before being stored. This can be exploited to execute arbitrary PHP code.

Successful exploitation of this vulnerability requires valid administrator credentials.

6) Input appended to the URL after view/ is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

7) Input passed to the "search[type]", "search[fromage]", and "search[toage]" parameters (when "req" is set to "dosearch") in index.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Note: This may further be exploited to conduct cross-site scripting attacks, when an improper SQL query triggers an error message.

Solution
Edit the source code to ensure that input is properly sanitised. Grant administrator access to trusted users only.

Provided and/or discovered by
1 - 5) Corwin
6) e.wiZz!
7) Andrea Bocchetti. Additional information provided by an anonymous person.

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/6312
http://packetstormsecurity.org/0912-exploits/krateview-sql.txt
http://packetstormsecurity.org/files/100296/K-Rate-Advanced-Picture-Rating-Cross-Site-Scripting.html

Deep Links
Links available in Customer Area