bugtraq - [SECURITYREASON.COM][phpBB 2.0.13 SQL error in session cXIb8O3.8]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 12 Mar 2005 01:12:54 -0000
From: Maksymilian Arciemowicz <max@...tsuper.pl>
To: bugtraq@...urityfocus.com
Subject: [SECURITYREASON.COM][phpBB 2.0.13 SQL error in session cXIb8O3.8]




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[phpBB 2.0.13 SQL error in session cXIb8O3.8]

Author: Maksymilian Arciemowicz (cXIb8O3)
Date: 10.3.2005
from securityreason.com TEAM

- --- 0.Description ---
phpBB is a high powered, fully scalable, and highly customizable Open Source bulletin board package. phpBB has a user-friendly interface, simple and straightforward administration panel, and helpful FAQ. Based on the powerful PHP server language and your choice of MySQL, MS-SQL, PostgreSQL or Access/ODBC database servers, phpBB is the ideal free community solution for all web sites. 
Contact with author http://www.phpbb.com/about.php. 

- --- 1. Session SQL error ---
Error is non critical but is very interesting because is specific.
If you don`t have cookies in forum, go to for exemple:

URL1# http://[HOST]/[DIR]/modcp.php?mode=delete&t=-99&sid=

or

URL2# http://[HOST]/[DIR]/modcp.php?mode=move&t=-99&sid=

etc. 
And have you fun error.

Error message :
- ---------------
phpBB : Critical Error

Error creating new session

DEBUG MODE

SQL Error : 1064 You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near ' 0)' at line 3

INSERT INTO phpbb_sessions (session_id, session_user_id, session_start, session_time, session_ip, session_page, session_logged_in) VALUES ('f908cee2ec0ceabe41c17c16198d6ff5', -1, 1107468751, 1107468751, '7f000001', , 0)

Line : 158
File : /www/phpBB2/includes/sessions.php
- ---------------

Sql injection? No! Why? Because you don`t can insert varible to querty.

And some what.. if you have cookie try to go to this url and can you see next error.

Error message :
- ---------------
phpBB : Critical Error

Error updating sessions table

DEBUG MODE

SQL Error : 1064 You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE session_id = '06f01a9adbc6777f54039ab745c038f7'' at line

UPDATE phpbb_sessions SET session_time = 1107469991, session_page = WHERE session_id = '06f01a9adbc6777f54039ab745c038f7'

Line : 279
File : /www/phpBB2/includes/sessions.php
- ---------------

What is wrong? Wrong is variable $page_id in function session_begin() [ERROR1] and variable $thispage_id in function session_pagestart()[ERROR2]. Frist function try start new session but variable $page_id don't exist and then we see error in sql query.
Next function try change something in session but variable don`t exist and this is a problem.

Example sql query is:

INSERT INTO phpbb_sessions (session_id, session_user_id, session_start, session_time, session_ip, session_page, session_logged_in) VALUES ('26fc83315ce07d83a68014f18ccf3486', -1, 1110470967, 1110470967, '7f000001', , 0)

- --- 2. Greets ---

sp3x 

and 

suicide

- --- 3.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
securityreason.com TEAM

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)

iD8DBQFCMKw+znmvyJCR4zQRAs/tAKCNX0gxJFc92C9XSEDKd6XOdvUZxwCdHxbQ
/cC6esYDFKq2Q5GqEsssStc=
=JsX0
-----END PGP SIGNATURE-----