UBBThreads Input Validation Hole in 'showflat.php' Permits SQL Injection Attacks
|
|
SecurityTracker Alert ID: 1015549
|
|
SecurityTracker URL: http://securitytracker.com/id?1015549
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jan 29 2006
|
Impact: Disclosure of system information, Disclosure of user information, User access via network
|
Exploit Included: Yes
|
Version(s): 6.3 and prior versions
|
Description: k-otik of The Noxistes Team reported a vulnerability in UBBThreads. A remote user can inject SQL commands.
The 'showflat.php' script does not properly validate user-supplied input in the 'Number' parameter. A remote user can supply a specially
crafted parameter value to execute SQL commands on the underlying database.
A demonstration exploit URL is provided:
http://[target]/[forum]/showflat.php?Cat=&Numbe
r=19229%20UNION%20SELECT%201,2%20/*&page=0&view=collapsed&sb=5&o=&fpart=1
|
Impact: A remote user can execute SQL commands on the underlying database.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.ubbcentral.com/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Jean-baptiste Reaper <kotik17@gmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 29 Jan 2006 06:16:40 +0100
From: Jean-baptiste Reaper <kotik17@gmail.com>
Subject: Hello
|
UBB Forum SQL Injection Vulnerability
################################################
Software: UBB Forum
Sowtware's Web Site: http://www.ubbcentral.com/
Versions: 6.3 and lower certainly
Critical Level: Moderate
Class: Remote
Status: Unpatched
Exploit: Available
Solution: Not Available
Discovered by: k-otik (http://www.noxistes.org)
Mail: kotik17@gmail.com
-----------------Description---------------
Vulnerable script: showflat.php
Variable $Number isn't properly sanitized before being used in a SQL
query. This can be used to make any SQL query by injecting arbitrary SQL
code.
Proof of concept:
[infos, 19229 is an arbitrary value of Number]
http://[domaine]/[forum]/showflat.php?Cat=&Number=19229'&page=0'&view=collapsed&sb=5&
o=&fpart=1
The url above generates an SQL Error.
Debug => SQL ERROR: Sat, Jan 28 2006 20:59:20 -0800 Database error only visible to forum administr
ators
We can successfully inject arbritrary SQL code.
Return false: http://[domaine]/[forum]/showflat.php?Cat=&Number=19229%20and%201=2&page=0&
view=collapsed&sb=5&o=&fpart=1
Return true: http://[domaine]/[forum]/showflat.php?Cat=&Number=19229%20and%201=1&page=0'&
view=collapsed&sb=5&o=&fpart=1
Exploit:
http://[domaine]/[forum]/showflat.php?Cat=&Number=19229%20UNION%20SELECT%201,2%20/*&page=0&
view=collapsed&sb=5&o=&fpart=1
--------------Solution---------------------
No Patch available.
--------------Credit-----------------------
The Noxistes Team.
We are N-0-X, Warfo, Tchess, Logik and k-otik
Discovered by: k-otik (http://www.noxistes.org)
|
|
