bugtraq - Re: sql injection in phpbb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: 11 Nov 2003 08:26:47 -0600
From: Jayson Anderson <bugtraq@...ick.com>
To: telli@...ezwiz.com
Cc: bugtraq@...urityfocus.com
Subject: Re: sql injection in phpbb


I just grabbed 2.0.6 the other day and this fix is implemented. I'm
seeing the fix starting at (my) line 80 in file
'includes/functions.php'.

It is placed directly above the following unique instance of code you
should currently have: 

"$sql = "SELECT *
                FROM " . USERS_TABLE . "
                WHERE ";
$sql .= ( ( is_integer($user) ) ? "user_id = $user" : "username = '" . 
$user . "'" ) . " AND user_id <> " . ANONYMOUS; "

which should be somewhere around line 60-70 in your current
includes/functions.php file.  That is the only instance. 

hth
Jayson


On Mon, 2003-11-10 at 12:46, telli@...ezwiz.com wrote:
> In-Reply-To: <3FAD4685.2040907@...se.net>
> 
> >Received: (qmail 32171 invoked from network); 8 Nov 2003 21:06:28 -0000
> >Received: from outgoing3.securityfocus.com (205.206.231.27)
> >  by mail.securityfocus.com with SMTP; 8 Nov 2003 21:06:28 -0000
> >Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> >	by outgoing3.securityfocus.com (Postfix) with QMQP
> >	id 34703A30B1; Sat,  8 Nov 2003 14:13:37 -0700 (MST)
> >Mailing-List: contact bugtraq-help@...urityfocus.com; run by ezmlm
> >Precedence: bulk
> >List-Id: <bugtraq.list-id.securityfocus.com>
> >List-Post: <mailto:bugtraq@...urityfocus.com>
> >List-Help: <mailto:bugtraq-help@...urityfocus.com>
> >List-Unsubscribe: <mailto:bugtraq-unsubscribe@...urityfocus.com>
> >List-Subscribe: <mailto:bugtraq-subscribe@...urityfocus.com>
> >Delivered-To: mailing list bugtraq@...urityfocus.com
> >Delivered-To: moderator for bugtraq@...urityfocus.com
> >Received: (qmail 3716 invoked from network); 8 Nov 2003 13:30:08 -0000
> >Message-ID: <3FAD4685.2040907@...se.net>
> >Date: Sat, 08 Nov 2003 20:39:49 +0100
> >From: Marius Kaase <marius@...se.net>
> >Reply-To: marius@...se.net
> >User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6a) Gecko/20031105 Thunderbird/0.4a
> >X-Accept-Language: en-us, en
> >MIME-Version: 1.0
> >To: jocanor jocanor <jocanor2002@...mail.com>
> >Cc: bugtraq@...urityfocus.com
> >Subject: Re: sql injection in phpbb
> >References: <20031108183025.19866.qmail@...www2-symnsj.securityfocus.com>
> >In-Reply-To: <20031108183025.19866.qmail@...www2-symnsj.securityfocus.com>
> >Content-Type: text/plain; charset=us-ascii; format=flowed
> >Content-Transfer-Encoding: 7bit
> >
> >jocanor jocanor wrote:
> >
> >> 
> >> I found a vulnerability en phpbb 2.0.5 and prior, is probably also affect 2.0.6
> >> 
> >> this bug don't affect to version 2.0.7 
> >> 
> >> phpbb have a list of registereds users, when you click on a memebr of this list, you are requesting data to the database 
> >> 
> >> for example:
> >> 
> >> http://www.example.com/forum/profile.php?mode=viewprofile&u=2
> >> 
> >> this url show the information to the user with the uid = 2, the uid is a number assigned to users in phpbb.
> >> 
> >> but it isn't secure, because if you use this url, you can inject sql comands...
> >> 
> >> exploit:
> >> 
> >> http://www.example.com/profile.php?mode=viewprofile&u='[sqlcode]
> >> 
> >> where [sql code] represents the code may be injected.
> >> 
> >
> >Does not affect 2.0.6.
> >
> >This code prevents it:
> >
> >function get_userdata($user, $force_str = false)
> >{
> >global $db;
> >
> >if (intval($user) == 0 || $force_str)
> >{
> >$user = trim(htmlspecialchars($user));
> >$user = substr(str_replace("\\'", "'", $user), 0, 25);
> >$user = str_replace("'", "\\'", $user);
> >}
> >else
> >{
> >$user = intval($user);
> >}
> >
> >(Taken from: http://www.phpbb.com/phpBB/viewtopic.php?p=848495)
> >
> >-- 
> >
> >Kind Regards
> >Marius Kaase
> >
> >"If the Phone Doesn't Ring, It's Me"
> >
> Ok now where exactly would one include this information to tighten the security? After going through all profile pages  (running 2.0.6) I found nothing like this Are we sure it is included in 2.0.6? I think if the files that need to be fixed can be listed we can start to work on this fix.
> 
> Telli    
>