[BOGUS] SMF vulnerability - SQL injection

[nasko100]

http://www.securityfocus.com/bid/15791

http://www.securityfocus.com/archive/1/419068


Please, comment.   

[!Hachi!]

developers can answer this
    but if you see     
Vulnerable:      Simple Machines SMF 1.1 rc1             

[Grudge]

I've replied to the original message over there:

I'm a developer from over at simplemachines and I do not see how this can pose an exploit? Let's examine the code piece by piece:

The code is entered at this point:
if (!is_numeric($_REQUEST['start']))

So, will be executed if $_REQUEST['start'] is a string. It's then used in the query. However, it's used in the query in this piece of code:

substr(strtolower($_REQUEST['start']), 0, 1)

So, the string is set to lower case, and then only the FIRST letter is used within the query. How can anyone exploit the database with a one character insertion? Of course this is within single quotes as well, so it cannot even be a command.

I simply cannot see how you could possibly exploit SQL from this?

[Grudge]

Note I've also emailed security focus to request it's removed from their database.

[nasko100]

Thanks for the info!