XennoBB Profile.PHP Multiple SQL Injection Vulnerabilities

Bugtraq ID:	19374
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 07 2006 12:00AM
Updated:	Aug 11 2006 01:20AM
Credit:	Chris Boulton is credited with the discovery of these vulnerabilities.
Vulnerable:	XennoBB XennoBB 2.1
Not Vulnerable:	XennoBB XennoBB 2.2

XennoBB Profile.PHP Multiple SQL Injection Vulnerabilities

XennoBB is prone to multiple SQL injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful attack could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

These issues affect version 2.1.0; earlier versions may also be vulnerable.

XennoBB Profile.PHP Multiple SQL Injection Vulnerabilities

Attackers can exploit this issue via a web client.

Submitting the following as a POST request to profile.php is sufficient to exploit these issues and gain administrative privileges:

form_sent=1&form[sex]=a&bday_day=1&bday_month=2&bday_year=", group_id=1, birthday="

XennoBB Profile.PHP Multiple SQL Injection Vulnerabilities

Solution:
Vendor released version 2.2.0 to address this issue. Please see the references for more information.

XennoBB Profile.PHP Multiple SQL Injection Vulnerabilities

References:

• Update: XennoBB 2.2.0 (XennoBB)
  
• XennoBB Homepage (XennoBB)
  
• [email protected] (XennoBB <= 2.1.0 "birthday" SQL injection)