Description
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
zyx0814 FilePress
Default version status: unaffected
0 to ≤ 3.0.1affected
pkg:github/zyx0814/FilePressReferences
- https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-orderby-sqli ↗
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L93 ↗
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L594-L642 ↗
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/collection/filelist.php#L453-L496 ↗
- https://github.com/zyx0814/FilePress ↗
- https://www.vulncheck.com/advisories/filepress-through-3.0.1-sql-injection-via-asc-parameter-in-filelist-php ↗