bugtraq - [bWM#015] SQL-Injection @ Woltlab Burning Board + MOD Guthabenhack 1.3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <27550198$10596789133f296ac13eeb32.58508703@config1.schlund.de>
Date: Thu, 31 Jul 2003 21:18:02 +0200
From: <ben.moeckel@...webmasters.net>
To: <bugtraq@...urityfocus.com>
Subject: [bWM#015]  SQL-Injection @ Woltlab Burning Board + MOD Guthabenhack 1.3

http://badWebMasters.net
ben moeckel security research 
------------------------------------------------- 

badWebMasters security advisory #015 

SQL-Injection @ Woltlab Burning Board + MOD Guthabenhack 1.3 

Discovery Date: 2003-07-28 

Original Advisory:
http://badwebmasters.net/adv/015/ (text/html) 

Legal Notice:
Copyright 2003 by Benjamin Klimmek (ben moeckel - badWebMasters)!
You may distribute it unmodified.
You may not modify it and distribute it or distribute parts of it
without giving credits and the URL where the original advisory can be
found!
This document may change without notice. 

Author:
ben moeckel (http://distressed.de)
mailto: badwebmasters@...ine.de 

Description:
With the "Guthaben hack" (that includes Zwerg's "User Werben Hack" 3.0)
for Woltlab Burning Board you can get credits for promoting new members.
The new user may add the promoter's ID into the registration form, so he
can get his credits.

Due to an input validation bug the "User Werben"-MOD is vulnerable to an
sql-injection attack. This makes it possible for an malicious user to
gain admin rights. 

Exploit:
The field got a maxlength-value of 10, so the attacker may use IE +
javascript to inject the sql-string:

javascript:x=document.forms[0].geworbenv;x.value=",
groupid=1";alert(x.value);

Vendor:
Vendor has been contacted by php-masta, no reply received. 

Thanks:
php-masta (php-masta.net) for inviting me to join his board ;)

Feedback:
Comments, suggestions, updates, anything else?
   -> mailto:badwebmasters@...ine.de 

------------------------------------------------- 
http://badWebMasters.net
ben moeckel security research 
copyright 2k1-3 by Benjamin Klimmek / Germany.
mailto:badwebmasters@...ine.de