bugtraq - MercuryBoard 1.1.4 SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050621163205.29590.qmail@securityfocus.com>
Date: 21 Jun 2005 16:32:05 -0000
From: 4yka@....ru
To: bugtraq@...urityfocus.com
Subject: MercuryBoard  1.1.4 SQL Injection


RST/GHC Advisory #28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Product : MercuryBoard 
Version : 1.1.4

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FILE : index.php
VULN : SQL injection

CODE : 
global.php
----------
71 : $this->agent   = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : null;

index.php
---------
154 : $mercury->db->query("REPLACE INTO {$mercury->pre}active (active_id, active_action, active_item, active_time, 
active_ip, active_user_agent, active_session) VALUES ({$mercury->user['user_id']}, '{$mercury->get['a']}', $item, 
$mercury->time, '$mercury->ip', '$mercury->agent', '{$mercury->session['id']}')");

INFO : 
-->--
GET /mercuryboard/ HTTP/1.1
User-Agent: 666'
Host: 127.0.0.1
--<--
...
You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right 
syntax to use near 'aa3211413f374429d3830cd062b25b86')' at line 1
Query Error [1064]:
This type of error is reported by MySQL.
Query: REPLACE INTO mb_active (active_id, active_action, active_item, active_time, active_ip, active_user_agent, active_session) VALUES (1, 'board', 0, 1116314234, '127.0.0.1', '666'', 'aa3211413f374429d3830cd062b25b86')
...

EXPLOIT:
http://rst.void.ru/download/r57mercury.txt
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1dt.w0lf 
RST/GHC
http://rst.void.ru
http://ghc.ru