Bonsai Information Security - Vulnerability Research

SQL Injection in Achievo

1. Advisory Information

Advisory ID: BONSAI-2009-0102
Date published: 2009-08-25
Vendors contacted: Achievo
Release mode: Coordinated release

2. Vulnerability Information

Class: SQL Injection
Remotely Exploitable: Yes
Locally Exploitable: YES
CVE Name: TBD

3. Software Description

Achievo is a flexible web-based resource management tool for business environments. Achievo's resource management capabilities will enable organisations to support their business processes in a simple, but effective manner [0].

4. Vulnerability Description

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.

For additional information, please read [1] and [2].

5. Vulnerable packages

Version <= 1.3.4

6. Non-vulnerable packages

Achievo developers informed us that all users should upgrade to the latest version of Achievo, which fixes this vulnerability. More information to be found here:
http://www.achievo.org/

7. Credits

This vulnerability was discovered by Ryan Dewhurst ( ryan -at- bonsai-sec.com ).

8. Technical Description

A SQL injection vulnerability was found in the dispatch.php script, more specifically in the $user_id variable. The vulnerability can be triggered by logging into Achievo and browsing to:

/dispatch.php?atknodetype=reports.weekreport&atkaction=report&
nameswitch=name&userid=%27&functionlevelswitch=all&startdate[day]=6
&startdate[month]=7&startdate[year]=2009&enddate[day]=17&enddate[month]
=7&enddate[year]=2009&showstatus=all&outputType=0&atkorderby=period

Which will generate a syntax error in the database. The following is the corresponding piece of code:

classweekreport.inc:128-134
function get_employee($user_id)
{
    $db = &atkGetDb();
    $sql = "SELECT * FROM person WHERE status='active' AND id='$user_id'";
    $record = $db->getrows($sql);
    return $record[0];
}

9. Report Timeline

2009-07-06:

2009-08-08:

2009-08-25:

10. References

[0] http://www.achievo.org/

[1] http://www.owasp.org/index.php/SQL_injection

[2] http://en.wikipedia.org/wiki/SQL_injection

11. About Bonsai

Bonsai is a company involved in providing professional computer information security services. Currently a sound growth company, since its foundation in early 2009 in Buenos Aires, Argentina, we are fully committed to quality service, and focused on our customers real needs.