All Projects

Summary:-

The getfile parameter at https://security.alwaysdata.com/ appears to be insufficiently validated. Appending a single quote (') to the parameter causes a PostgreSQL database error, revealing the backend SQL query and parameter value.

Step to repro:-

1. Open the following URL:
https://security.alwaysdata.com/?getfile=1%27

2. Observe the returned error:
Query {SELECT t.project_id, a.orig_name, a.file_name, a.file_type, t.* FROM "flyspray_attachments" a INNER JOIN "flyspray_tasks" t ON a.task_id = t.task_id WHERE attachment_id = ?} with params {1'} failed!

ERROR: invalid input syntax for type integer: "1'"
CONTEXT: unnamed portal parameter $1 = '…'

3. The error indicates that the supplied getfile value is being passed to a PostgreSQL query as a parameter and that the application exposes internal SQL/database error details.

Impact:
Database error messages are exposed to unauthenticated users.
Internal SQL query structure and database implementation details are disclosed.
If the parameter is vulnerable beyond type validation/parameter handling, this could potentially lead to SQL injection and unauthorized database access.
The disclosed SQL details can assist further targeted attacks.