BID:14195

PunBB Profile.PHP User Profile Edit Module SQL Injection Vulnerability

Info

PunBB Profile.PHP User Profile Edit Module SQL Injection Vulnerability

Bugtraq ID:	14195
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 08 2005 12:00AM
Updated:	Jul 08 2005 12:00AM
Credit:	Discovery is credited to Stefan Esser <[email protected]> with Hardened-PHP Project.
Vulnerable:	PunBB PunBB 1.2.5 PunBB PunBB 1.2.4 PunBB PunBB 1.2.3 PunBB PunBB 1.2.2 PunBB PunBB 1.2.1 PunBB PunBB 1.1.5 PunBB PunBB 1.1.4 PunBB PunBB 1.1.3 PunBB PunBB 1.1.2 PunBB PunBB 1.1.1 PunBB PunBB 1.1 PunBB PunBB 1.0.1 PunBB PunBB 1.0 RC2 PunBB PunBB 1.0 RC1 PunBB PunBB 1.0 _beta3 PunBB PunBB 1.0 _beta2 PunBB PunBB 1.0 _beta1 PunBB PunBB 1.0 _alpha PunBB PunBB 1.0

Not Vulnerable:	PunBB PunBB 1.2.6

Discussion

PunBB Profile.PHP User Profile Edit Module SQL Injection Vulnerability

PunBB is affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input through the user profile edit module of the 'profile.php' script before using it in a SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue may be successfully exploited to gain administrative access to a vulnerable forum.

PunBB 1.2.5 and prior versions are vulnerable.

Exploit / POC

PunBB Profile.PHP User Profile Edit Module SQL Injection Vulnerability

No exploit is required.

Injecting the following can allow the attacker to gain administrative privileges:

temp[0]=group_id=1

Solution / Fix

PunBB Profile.PHP User Profile Edit Module SQL Injection Vulnerability

Solution:
The vendor has released PunBB 1.2.6 to address this issue.

PunBB PunBB 1.0 RC1