phpBB Auction Mod Lets Remote Users Inject SQL Commands and Determine the Installation Path
|
|
SecurityTracker Alert ID: 1013779 |
|
SecurityTracker URL: http://securitytracker.com/id/1013779
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 21 2005
|
Impact:
Disclosure of system information, Disclosure of user information
|
Exploit Included: Yes
|
Version(s): 1.2m and prior versions
|
Description:
sNKenjoi reported a vulnerability in phpBB Auction Mod. A remote user can inject SQL commands. A remote user can also determine the installation path.
The 'audtion_rating.php' and 'auction_offer.php' scripts do not properly validate user-supplied input. A remote user can submit a specially crafted request to execute SQL commands on the underlying database.
Some demonstration exploit URLs are provided:
http://[target]/auction_rating.php?mode=3Dview&u=3D'
http://[target]/auction_offer.php?mode=3Dadd&ar=3D'
A remote user can also determine the installation path with the following type of URL:
http://[target]/auction_myauctions.php?mode=3Df00b4r
The original advisory is available at:
http://snkenjoi.com/secadv/secadv9.txt
|
Impact:
A remote user can execute SQL commands on the underlying database.
A remote user can determine the installation path.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.phpbb-auction.com/ (Links to External Site)
|
Cause:
Access control error, Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 20 Apr 2005 21:48:04 +0000
Subject: sNKenjoi's Security Advisory: [ZH2005-12SA] SQL Injection & Full Path Disclosure in phpBB Auction
|
sNKenjoi's Security Advisory: [ZH2005-12SA] SQL Injection & Full Path
Disclosure in phpBB Auction
Security Advisory: SQL Injection & Full Path Disclosure in phpBB Auction
Severity: High
Title: SQL Injection & Full Path Disclosure in phpBB Auction
Versions
phpBB: Any Version
Auction Mod: Version 1.2m (and below)
Vendor: phpBB-Auction
Vendor Website: http://www.phpbb-auction.com/
Proof of Concept Exploits:=20
SQL Injection (Full Path Disclosure also works sometimes)
http://localhost/auction_rating.php?mode=3Dview&u=3D'
http://localhost/auction_offer.php?mode=3Dadd&ar=3D'
Full Path Disclosure
http://localhost/auction_myauctions.php?mode=3Df00b4r
(For some you will have to be logged in)
snkenjoi.com & zone-h.org
snkenjoi@gmail.com
(Original URL: snkenjoi.com/secadv/secadv9.txt)
|
|
