phpBB Auction Mod Lets Remote Users Inject SQL Commands and Determine the Installation Path
|
|
SecurityTracker Alert ID: 1013779
|
|
SecurityTracker URL: http://securitytracker.com/id?1013779
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 21 2005
|
Impact: Disclosure of system information, Disclosure of user information
|
Exploit Included: Yes
|
Version(s): 1.2m and prior versions
|
Description: sNKenjoi reported a vulnerability in phpBB Auction Mod. A remote user can inject SQL commands. A remote user can also determine the installation path.
The 'audtion_rating.php' and 'auction_offer.php' scripts do not properly validate user-supplied input. A remote user can submit
a specially crafted request to execute SQL commands on the underlying database.
Some demonstration exploit URLs are provided:
http://[target]/auction_rating.php?mod
e=3Dview&u=3D'
http://[target]/auction_offer.php?mode=3Dadd&ar=3D'
A remote user can also determine the installation path with
the following type of URL:
http://[target]/auction_myauctions.php?mode=3Df00b4r
The original advisory is available at:
http://snkenjoi.com/secadv/secadv9.txt
|
Impact: A remote user can execute SQL commands on the underlying database.
A remote user can determine the installation path.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.phpbb-auction.com/ (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Thom <snkenjoi@gmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 20 Apr 2005 21:48:04 +0000
From: Thom <snkenjoi@gmail.com>
Subject: sNKenjoi's Security Advisory: [ZH2005-12SA] SQL Injection & Full Path Disclosure in phpBB Auction
|
sNKenjoi's Security Advisory: [ZH2005-12SA] SQL Injection & Full Path
Disclosure in phpBB Auction
Security Advisory: SQL Injection & Full Path Disclosure in phpBB Auction
Severity: High
Title: SQL Injection & Full Path Disclosure in phpBB Auction
Versions
phpBB: Any Version
Auction Mod: Version 1.2m (and below)
Vendor: phpBB-Auction
Vendor Website: http://www.phpbb-auction.com/
Proof of Concept Exploits:=20
SQL Injection (Full Path Disclosure also works sometimes)
http://localhost/auction_rating.php?mode=3Dview&u=3D'
http://localhost/auction_offer.php?mode=3Dadd&ar=3D'
Full Path Disclosure
http://localhost/auction_myauctions.php?mode=3Df00b4r
(For some you will have to be logged in)
snkenjoi.com & zone-h.org
snkenjoi@gmail.com
(Original URL: snkenjoi.com/secadv/secadv9.txt)
|
|
