phpGB SQL Injection Vulnerability
BID:5673
Info
phpGB SQL Injection Vulnerability
| Bugtraq ID: | 5673 |
| Class: | Configuration Error |
| CVE: |
CVE-2002-1482 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 09 2002 12:00AM |
| Updated: | Jul 11 2009 05:06PM |
| Credit: | Discovery credited to ppp-design |
| Vulnerable: |
phpGB phpGB 1.3 phpGB phpGB 1.2 phpGB phpGB 1.1 |
| Not Vulnerable: |
phpGB phpGB 1.4 |
Discussion
phpGB SQL Injection Vulnerability
phpGB is vulnerable to a SQL injection vulnerability.
The cause of the issue is that the bulletin board relies on the PHP magic_quotes_gpc directive to sanitize variables that are used in SQL queries.
If magic_quotes_gpc is not enabled, then it will be possible for attackers to mount SQL injection attacks through the gestbook. SQL injection may allow attackers to corrupt the database. It is also possible to exploit this issue to gain administrative guestbook privileges.
phpGB is vulnerable to a SQL injection vulnerability.
The cause of the issue is that the bulletin board relies on the PHP magic_quotes_gpc directive to sanitize variables that are used in SQL queries.
If magic_quotes_gpc is not enabled, then it will be possible for attackers to mount SQL injection attacks through the gestbook. SQL injection may allow attackers to corrupt the database. It is also possible to exploit this issue to gain administrative guestbook privileges.
Exploit / POC
phpGB SQL Injection Vulnerability
The following proof of concept was supplied by ppp-design:
Use an existing administrator name (default is admin) and use the
following password:
"' OR 'a'='a"
The following proof of concept was supplied by ppp-design:
Use an existing administrator name (default is admin) and use the
following password:
"' OR 'a'='a"
References
phpGB SQL Injection Vulnerability
References:
References: