SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   WoltLab Burning Board (wBB) Vendors:   Woltlab
WoltLab Burning Board 3rd Party User Werben Hack/Guthabenhack Add-ons Permit SQL Injection
SecurityTracker Alert ID:  1007359
SecurityTracker URL:  http://securitytracker.com/id/1007359
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jul 31 2003
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): Zwerg's "User Werben Hack" (3.0)
Description:   A vulnerability was reported in the "User Werben Hack" 3rd party modification for WoltLab Burning Board. A remote user can gain administrative access to the application. The flaw also affects "Guthabenhack".

badWebMasters reported that Zwerg's "User Werben Hack" (3.0) for WoltLab Burning Board contains an input validation flaw. The flaw does not reside in WoltLab Burning Board software, according to the report.

The code that accepts credits from the new user registration form reportedly does not properly validate the user-supplied promoter's ID value. It was reported that a remote user can insert specially crafted characters to insert SQL commands to gain administrative access to the application.

A demonstration exploit method is described in the Source Message.

The vendor has reportedly been notified.

The original advisory is available at:

http://badwebmasters.net/adv/015/

[Editor's note: The advisory was not available at that address at the time of this entry.]

Impact:   A remote user can inject some SQL commands to be authenticated to the application as an administrator.
Solution:   No solution was available at the time of this entry.
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [bWM#015] SQL-Injection @ Woltlab Burning Board + MOD Guthabenhack 1.3



http://badWebMasters.net
ben moeckel security research 
------------------------------------------------- 

badWebMasters security advisory #015 

SQL-Injection @ Woltlab Burning Board + MOD Guthabenhack 1.3 


Discovery Date: 2003-07-28 
  
Original Advisory:
http://badwebmasters.net/adv/015/ (text/html) 
 
 
Legal Notice:
Copyright 2003 by Benjamin Klimmek (ben moeckel - badWebMasters)!
You may distribute it unmodified.
You may not modify it and distribute it or distribute parts of it
without giving credits and the URL where the original advisory can be
found!
This document may change without notice. 
 
  
Author:
ben moeckel (http://distressed.de)
mailto: badwebmasters@online.de 
 
  
Description:
With the "Guthaben hack" (that includes Zwerg's "User Werben Hack" 3.0)
for Woltlab Burning Board you can get credits for promoting new members.
The new user may add the promoter's ID into the registration form, so he
can get his credits.

Due to an input validation bug the "User Werben"-MOD is vulnerable to an
sql-injection attack. This makes it possible for an malicious user to
gain admin rights. 
 
  
Exploit:
The field got a maxlength-value of 10, so the attacker may use IE +
javascript to inject the sql-string:

javascript:x=document.forms[0].geworbenv;x.value=",
groupid=1";alert(x.value);
 
  
Vendor:
Vendor has been contacted by php-masta, no reply received. 
 
  
Thanks:
php-masta (php-masta.net) for inviting me to join his board ;)
 
  
Feedback:
Comments, suggestions, updates, anything else?
   -> mailto:badwebmasters@online.de 
 
  

------------------------------------------------- 
http://badWebMasters.net
ben moeckel security research 
copyright 2k1-3 by Benjamin Klimmek / Germany.
mailto:badwebmasters@online.de

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC