[MaxPatrol] SQL-injection in Ikonboard 3.1.x

2004-12-16T00:00:00
ID SECURITYVULNS:DOC:7357
Type securityvulns
Reporter Securityvulns
Modified 2004-12-16T00:00:00

Description

[MaxPatrol] SQL-injection in Ikonboard 3.1.x

Release Date: December 16, 2004 Date Reported: December 2, 2004 Severity: High Application: Ikonboard 3.1.x Affects versions: 3.1.0, 3.1.1, 3.1.2 and 3.1.3. Platform: PHP

I. DESCRIPTION

Input passed to the "st" and "keywords" parameters in "ikonboard.cgi" is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

1) SQL injection in "st" parameter

Example: http://host/support/ikonboard.cgi?act=ST&f=27&t=13066&hl=nickname&st=1'

Result: Ikonboard CGI Error


Ikonboard has exited with the following error:

Can't query the data from 'forum_posts' Reason: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '', 20'

This error was reported at: line 1 Query: SELECT * FROM iB313_forum_posts WHERE TOPIC_ID = '13066' AND QUEUED <> '1' ORDER BY POST_DATE ASC LIMIT 1', 20

Please note that your 'real' paths have been removed to protect your information.

2) SQL injection in "keywords" parameter

Example: http://host/support/ikonboard.cgi?act=Search&CODE=01&keywords='&type=name&forums=all&search_in=all&prune=0

Result: Ikonboard CGI Error


Ikonboard has exited with the following error:

mySQL error Can't query the data: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near ') ORDER BY DATE DESC LIMIT 0,200'

This error was reported at: line 1

Please note that your 'real' paths have been removed to protect your information.

This vulnerability found automatically by full-featured commercial version of MaxPatrol.

II. IMPACT

A remote user may be able to execute arbitrary SQL commands on the underlying database.

III. SOLUTION

Not available currently.

IV. VENDOR FIX/RESPONSE

Notified.

V. CREDIT

This vulnerability was discovered by Positive Technologies using MaxPatrol (http://www.maxpatrol.com) - intellectual professional security scanner. It is able to detect a substantial amount of vulnerabilities not published yet. MaxPatrol's intelligent algorithms are also capable to detect a lot of vulnerabilities in custom web-scripts (XSS, SQL and code injections, HTTP Response splitting).