Invision Power Board SSI.PHP SQL Injection Vulnerability
BID:10511
Info
Invision Power Board SSI.PHP SQL Injection Vulnerability
| Bugtraq ID: | 10511 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 10 2004 12:00AM |
| Updated: | Jun 10 2004 12:00AM |
| Credit: | "JvdR" <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
Invision Power Services Invision Board 1.3.1 Final Invision Power Services Invision Board 1.3 |
| Not Vulnerable: | |
Discussion
Invision Power Board SSI.PHP SQL Injection Vulnerability
Invision Power Board is reported prone to an SQL injection vulnerability in its 'ssi.php' script.
Due to improper filtering of user supplied data, 'ssi.php' is exploitable by attackers to pass SQL statements to the underlying database.
The impact of this vulnerability depends on the underlying database. It may be possible to corrupt/read sensitive data, execute commands/procedures on the database server or possibly exploit vulnerabilities in the database itself through this condition.
Version 1.3.1 Final of Invision Power Board is reported vulnerable. Other versions may also be affected as well.
*** There have been conflicting reports stating the the vulnerable variable only accepts integer values and not arbitrary strings.
Invision Power Board is reported prone to an SQL injection vulnerability in its 'ssi.php' script.
Due to improper filtering of user supplied data, 'ssi.php' is exploitable by attackers to pass SQL statements to the underlying database.
The impact of this vulnerability depends on the underlying database. It may be possible to corrupt/read sensitive data, execute commands/procedures on the database server or possibly exploit vulnerabilities in the database itself through this condition.
Version 1.3.1 Final of Invision Power Board is reported vulnerable. Other versions may also be affected as well.
*** There have been conflicting reports stating the the vulnerable variable only accepts integer values and not arbitrary strings.
Exploit / POC
Invision Power Board SSI.PHP SQL Injection Vulnerability
No exploit is required.
A proof-of-concept example was provided by the reporter of this issue:
http://www.example.com/ssi.php?a=out&type=xml&f=0)[SQL-INJECTION]
No exploit is required.
A proof-of-concept example was provided by the reporter of this issue:
http://www.example.com/ssi.php?a=out&type=xml&f=0)[SQL-INJECTION]
Solution / Fix
Invision Power Board SSI.PHP SQL Injection Vulnerability
Solution:
The vendor has released a patch to address this issue in version 1.3. This patch has also been included in the IPB 1.3.1 and 1.3 releases since Feb 19th 2004:
Invision Power Services Invision Board 1.3
Solution:
The vendor has released a patch to address this issue in version 1.3. This patch has also been included in the IPB 1.3.1 and 1.3 releases since Feb 19th 2004:
Invision Power Services Invision Board 1.3
-
Invision Power Services ssi_feb04.zip
http://forums.invisionpower.com/index.php?act=Attach&type=post&id=1096
References
Invision Power Board SSI.PHP SQL Injection Vulnerability
References:
References:
- Invision Board Homepage (Invision Power Services)
- ssi.php Vulnerability: A Reminder (Matt)
- Re: Multiple Vulnerabilities in Invision Power Board v1.3.1 Final. (Hillel Himovich