SQL Injection in TestLink

Advisory ID: HTB23288
Product: TestLink
Vendor: TestLink Development Team
Vulnerable Version(s): 1.9.14 and probably prior
Tested Version: 1.9.14
Advisory Publication:  January 7, 2016  [without technical details]
Vendor Notification: January 7, 2016
Vendor Patch: January 9, 2016
Public Disclosure: February 17, 2016
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High
CVSSv3 Base Score: 7.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab (https://www.htbridge.com/advisory/ )

------------------------------
-----------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered high-risk SQL injection vulnerability in TestLink Open Source Test Management. The vulnerability can be exploited to alter the present SQL query and gain access to potentially sensitive information or even to completely compromise the vulnerable web application.

The vulnerability is caused by insufficient filtration of "apikey" HTTP GET parameter, passed to "lnl.php" PHP script. A remote unauthenticated attacker can inject and execute arbitrary SQL commands in application's database.

A simple exploit code below will display version of used MySQL server:

http://[host]/lnl.php?apikey=1239999999%27%20OR%201=%28IF%28MID%28version%28%29,1,1%29%20LIKE%205,%201,0%29%29%20--%202


-----------------------------------------------------------------------------------------------

Solution:

Update to TestLink 1.9.15

More Information:
http://mantis.testlink.org/view.php?id=7402

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23288 - https://www.htbridge.com/advisory/HTB23288 - SQL Injection in TestLink
[2] TestLink - http://testlink.org/ - TestLink Open Source Test Management
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.