WWWThreads SQL Command Input Vulnerability
BID:967
Info
WWWThreads SQL Command Input Vulnerability
| Bugtraq ID: | 967 |
| Class: | Input Validation Error |
| CVE: |
CVE-2000-0125 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 03 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | Discovered and by rain forest puppy <[email protected]> and posted to Bugtraq on February 3, 2000. |
| Vulnerable: |
Wired Community Software WWWThreads 5.0 |
| Not Vulnerable: | |
Discussion
WWWThreads SQL Command Input Vulnerability
WWWThreads is a web bulletin board program that uses an SQL backend. Due to incomplete input validation, it is possible for an attacker to submit SQL commands through forms and manipulate the contents of the database to gain administrator privileges over the database.
There are various ways for a program to ensure that all entries into data fields are interpreted as data and not SQL commands. WWWThreads uses the quote() function to do this on string values, but fails to verify numeric values in a similar manner. Therefore, SQL commands can be passed to WWWThreads via any numeric argument. These commands can be used to update the status of any user to Administrator and change their security level to '100' (the same level as the Administrator).
WWWThreads is a web bulletin board program that uses an SQL backend. Due to incomplete input validation, it is possible for an attacker to submit SQL commands through forms and manipulate the contents of the database to gain administrator privileges over the database.
There are various ways for a program to ensure that all entries into data fields are interpreted as data and not SQL commands. WWWThreads uses the quote() function to do this on string values, but fails to verify numeric values in a similar manner. Therefore, SQL commands can be passed to WWWThreads via any numeric argument. These commands can be used to update the status of any user to Administrator and change their security level to '100' (the same level as the Administrator).
Exploit / POC
WWWThreads SQL Command Input Vulnerability
Edit this file with the IP address or name of the desired target and a valid username and password hash for that server. The program will then elevate the specified user to administrator status.
Edit this file with the IP address or name of the desired target and a valid username and password hash for that server. The program will then elevate the specified user to administrator status.
Solution / Fix
WWWThreads SQL Command Input Vulnerability
Solution:
Wired Community Software has released a fixed version of WWWThreads, available at:
Demo version:
http://www.wwwthreads.com/download.html
Licensed version:
http://www.wwwthreads.com/licensed/
Solution:
Wired Community Software has released a fixed version of WWWThreads, available at:
Demo version:
http://www.wwwthreads.com/download.html
Licensed version:
http://www.wwwthreads.com/licensed/
References
WWWThreads SQL Command Input Vulnerability
References:
References:
- WWWThread Support Forum Post (Wired Community Software)
- WWWThreads Home Page (Wired Community Software)