bugtraq - [waraxe-2008-SA#069] - Multiple Sql Injection in vBulletin 3.7.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 17 Nov 2008 12:21:52 -0700
From: come2waraxe@...oo.com
To: bugtraq@...urityfocus.com
Subject: [waraxe-2008-SA#069] - Multiple Sql Injection in vBulletin 3.7.4


[waraxe-2008-SA#069] - Multiple Sql Injection in vBulletin 3.7.4
===============================================================================

Author: Janek Vind "waraxe"
Date: 17. November 2008
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-69.html


Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

vBulletin (abbreviated as vB) is a commercial Internet forum software produced
by Jelsoft Enterprises. It is written in PHP using a MySQL database server.
vBulletin is a professional, affordable community forum solution. Thousands of
clients, including many industry leading blue chip companies, have chosen
vBulletin - It's the ideal choice for any size of community.

Web: http://www.vbulletin.com/


List of found vulnerabilities
===============================================================================

1. Sql Injection in "admincp/verify.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Impact: low
Preconditions: attacker must have admin account with Human Verification Manager
administer privileges


[---------- source code snippet start ----------]
if ($_POST['do'] == 'updateanswer')
{
	$vbulletin->input->clean_array_gpc('p', array(
		'answer' => TYPE_STR,
	));
..
$db->query_write("
	UPDATE " . TABLE_PREFIX . "hvanswer
	SET answer = '" . $vbulletin->GPC['answer'] . "'
	WHERE answerid = " . $vbulletin->GPC['answerid']
);
[----------- source code snippet end -----------]

It appears, that user submitted parameter "answer" is not properly sanitized
before using in sql query. As result sql injection is possible. Test will 
induce sql error message:

Invalid SQL:
	UPDATE vb_hvanswer
	SET answer = 'war'axe'
	WHERE answerid = 1;


2. Sql Injection in "admincp/attachmentpermission.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Impact: low
Preconditions: attacker must have admin account with Attachment Permissions
Manager administer privileges

As in previous case, user submitted parameter, this time it's "extension", is
used in sql query without proper snaitization. This results sql injection 
vulnerability. For test log in as admin with needed privileges and then issue
GET request (using proper URI instead if example):

http://localhost/vbulletin374/admincp/attachmentpermission.php?do=edit&extension=war'axe

This results with error message from vBulletin:

Database error in vBulletin 3.7.4:
Invalid SQL:

	SELECT size, width, height
	FROM attachmenttype
	WHERE extension = 'war'axe';


3. Sql Injection in "admincp/image.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Impact: low
Preconditions: attacker must have admin account with Avatars administer privileges

[---------- source code snippet start ----------]
if ($_POST['do'] == 'updatepermissions')
{
	$vbulletin->input->clean_array_gpc('p', array(
		'iperm'           => TYPE_ARRAY,
		'imagecategoryid' => TYPE_INT
	));
..
foreach($vbulletin->GPC['iperm'] AS $usergroupid => $canuse)
{
	if ($canuse == 0)
	{
		$db->query_write("
			INSERT INTO " . TABLE_PREFIX . "imagecategorypermission
			(
				imagecategoryid,
				usergroupid
			)
			VALUES
			(
				" . $vbulletin->GPC['imagecategoryid'] . ",
				$usergroupid
			)
[----------- source code snippet end -----------]

User-submitted array "iperm" is used in sql query without proper sanitization.
This results in sql injection. Testing ends with error message:

MySQL Error   : Unknown column 'waraxe' in 'field list'


Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@...oo.com
Janek Vind "waraxe"

Waraxe forum:  http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
Php shell (work in progress): http://phpaxe.com/
---------------------------------- [ EOF ] ---------------------------------