bugtraq - Sql injection and global variables poisoning in XMB Forum 1.9.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050809120000.15558.qmail@securityfocus.com>
Date: 9 Aug 2005 12:00:00 -0000
From: heintz@...mail.com
To: bugtraq@...urityfocus.com
Subject: Sql injection and global variables poisoning in XMB Forum 1.9.1


Vendor notified at and partial patch:
http://forums.xmbforum.com/viewthread.php?tid=754523

firstly the input validation at xmb.php:

foreach ($global as $num => $array) {
if (is_array($array)) {
extract($array, EXTR_OVERWRITE);
}
}

this should put to not overwrite any variables cause
it overwrite server set variables too. this creates problems
when user submits a additional field in form:

<input type="text" name="_SERVER[REMOTE_ADDR]" value="555.555.555.555">


secondly there is a case of sql injection in include/u2u.inc.php
line ~491:
Code:

$in = '';
foreach ( $u2u_select as $value ) {
if ( $GLOBALS['type'.$value] != 'outgoing' ) {
$in .= ( empty( $in ) ) ? "$value" : ",$value";
}
}
...
$db->query( "UPDATE $table_u2u SET readstatus='no' WHERE u2uid IN($in) AND owner='$self[username]'" );

the variable $in is not actually validated and could and will cause problems if not fixed.

Greets #rainbowcrack and http://www.waraxe.us