XennoBBSQL.txt

`--------------------- SUMMARY ---------------------  
  
Name:  
XennoBB "icon_topic" SQL Injection (19/8/2006)  
  
Vendor / Product:  
XennoBB Group  
http://www.xennobb.com/  
  
Description:  
The world's most revolutionary and easy to use bulletin board.  
  
Revolutionary because it redefines the boundaries of usability  
and power; from the first version it's a real alternative to  
the commercial forums out there.  
  
How can XennoBB be described in few words?   
Lightning-speed, stable, SECURED(?) and modern.  
  
Version(s) Affected:  
All current (<= 2.2.1 at the time of the release)  
  
Severity:  
High  
  
Impact:  
SQL Injection (Remote)  
  
Status:  
Unpatched  
  
Discovered by:  
Chris Boulton <http://www.surfionline.com>  
  
Original advisory:  
http://www.surfionline.com/security_advisories/20060819_xennobb_icon_topic_sql.txt  
  
------------------- DESCRIPTION -------------------  
  
An exploit exists in the above mentioned versions of XennoBB which  
can be exploited by malicious users to conduct SQL injection attacks.  
  
Input passed to the "icon_topic" parameter in topic_post.php is not  
properly sanitised before being used in an SQL query. This exploit  
can lead to manipulation of SQL queries by injecting arbitary SQL code.  
  
--------------------- EXPLOIT ---------------------  
  
Submit a forged POST request to  
  
topic_post.php?action=post&fid={forum ID here}  
  
With the following as the POST data:  
  
form_sent=1&form_user={username here}&req_subject=Subject&req_message=Message&submit=1&icon_topic=[SQL]  
  
Successful exploitation leads would lead to the SQL query in the icon_topic  
parameter being run.  
  
--------------------- SOLUTION --------------------  
  
Ensure input is properly sanitized before being used in a database  
query.  
`