lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20060819073501.28029.qmail@securityfocus.com>
Date: 19 Aug 2006 07:35:01 -0000
From: c.boulton@...board.com
To: bugtraq@...urityfocus.com
Subject: XennoBB <= 2.2.1 "icon_topic" SQL Injection

--------------------- SUMMARY ---------------------

Name:
	XennoBB "icon_topic" SQL Injection (19/8/2006)

Vendor / Product:
	XennoBB Group
	http://www.xennobb.com/
	
	Description:
	The world's most revolutionary and easy to use bulletin board.

	Revolutionary because it redefines the boundaries of usability
	and power; from the first version it's a real alternative to
	the commercial forums out there.

	How can XennoBB be described in few words? 
	Lightning-speed, stable, SECURED(?) and modern.
	
Version(s) Affected:
	All current (<= 2.2.1 at the time of the release)
	
Severity:
	High
	
Impact:
	SQL Injection (Remote)

Status:
	Unpatched
	
Discovered by:
	Chris Boulton <http://www.surfionline.com>
	
Original advisory:
	http://www.surfionline.com/security_advisories/20060819_xennobb_icon_topic_sql.txt
	
------------------- DESCRIPTION -------------------

An exploit exists in the above mentioned versions of XennoBB which
can be exploited by malicious users to conduct SQL injection attacks.

Input passed to the "icon_topic" parameter in topic_post.php is not
properly sanitised before being used in an SQL query. This exploit
can lead to manipulation of SQL queries by injecting arbitary SQL code.

--------------------- EXPLOIT ---------------------

Submit a forged POST request to

topic_post.php?action=post&fid={forum ID here}

With the following as the POST data:

form_sent=1&form_user={username here}&req_subject=Subject&req_message=Message&submit=1&icon_topic=[SQL]

Successful exploitation leads would lead to the SQL query in the icon_topic
parameter being run.

--------------------- SOLUTION --------------------

Ensure input is properly sanitized before being used in a database
query.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ