vBulletin LAST.PHP SQL Injection Vulnerability
BID:11658
Info
vBulletin LAST.PHP SQL Injection Vulnerability
| Bugtraq ID: | 11658 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 11 2004 12:00AM |
| Updated: | Nov 11 2004 12:00AM |
| Credit: | "Dr. Death" <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
VBulletin VBulletin 3.0.3 VBulletin VBulletin 3.0.2 VBulletin VBulletin 3.0.1 |
| Not Vulnerable: | |
Discussion
vBulletin LAST.PHP SQL Injection Vulnerability
vBulletin is reported vulnerable to a remote SQL injection vulnerability. This issue is due to a failure of the application to properly validate user-supplied input prior to including it in an SQL query.
An attacker exploits this issue to manipulate and inject SQL queries onto the underlying database. It is reportedly possible to leverage this issue to steal database contents including administrator password hashes and user credentials as well as to attack the underlying database.
Update: It is reported that this vulnerability exists in third party scripts that can be used with vBulletin. Currently, the vendor of the affected scripts is not known. This BID will be updated as more information becomes available.
vBulletin is reported vulnerable to a remote SQL injection vulnerability. This issue is due to a failure of the application to properly validate user-supplied input prior to including it in an SQL query.
An attacker exploits this issue to manipulate and inject SQL queries onto the underlying database. It is reportedly possible to leverage this issue to steal database contents including administrator password hashes and user credentials as well as to attack the underlying database.
Update: It is reported that this vulnerability exists in third party scripts that can be used with vBulletin. Currently, the vendor of the affected scripts is not known. This BID will be updated as more information becomes available.
Exploit / POC
vBulletin LAST.PHP SQL Injection Vulnerability
An example URI sufficient to exploit this vulnerability has been provided:
http://www.example.com/last.php?fsel=,user.password%20as%20title,user.%20%20%20%20username%20as%20lastposter%20FROM%20user,thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT%201
An example URI sufficient to exploit this vulnerability has been provided:
http://www.example.com/last.php?fsel=,user.password%20as%20title,user.%20%20%20%20username%20as%20lastposter%20FROM%20user,thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT%201
Solution / Fix
vBulletin LAST.PHP SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
vBulletin LAST.PHP SQL Injection Vulnerability
References:
References:
- Vendor Homepage (Kyberna)
- SQL injection in vBulletin forums (last10.php) ("Dr. Death"
- Vulnerability not with vBulletin ("Kier Darby"