Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web BBS :: etc :: hack8508.htm

Ikonboard 3.1.x SQL Injection



[MaxPatrol] SQL-injection in Ikonboard 3.1.x





[MaxPatrol] SQL-injection in Ikonboard 3.1.x



   Release Date:     December 16, 2004

   Date Reported:    December 2, 2004

   Severity:         High

   Application:      Ikonboard 3.1.x

   Affects versions: 3.1.0, 3.1.1, 3.1.2 and 3.1.3.

   Platform:         PHP







I. DESCRIPTION



Input passed to the "st" and "keywords" parameters in "ikonboard.cgi" is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.





1) SQL injection in "st" parameter



Example:

http://host/support/ikonboard.cgi?act=ST&f=27&t=13066&hl=nickname &st=1'



Result:

Ikonboard CGI Error 

-----------------------------------------------------------------------

Ikonboard has exited with the following error: 



Can't query the data from 'forum_posts' Reason: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '', 20'



This error was reported at: line 1 Query: SELECT * FROM iB313_forum_posts WHERE TOPIC_ID = '13066' AND QUEUED <> '1' ORDER BY POST_DATE ASC LIMIT 1', 20 



Please note that your 'real' paths have been removed to protect your information. 

-----------------------------------------------------------------------





2) SQL injection in "keywords" parameter



Example:

http://host/support/ikonboard.cgi?act=Search&CODE=01&keywords=' &type=name&forums=all&search_in=all&prune=0



Result:

Ikonboard CGI Error 

-----------------------------------------------------------------------

Ikonboard has exited with the following error: 



mySQL error

Can't query the data: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near ') ORDER BY DATE DESC LIMIT 0,200'



This error was reported at: line 1 



Please note that your 'real' paths have been removed to protect your information. 

-----------------------------------------------------------------------





This vulnerability found automatically by full-featured commercial version of MaxPatrol.





II. IMPACT



   A remote user may be able to execute arbitrary SQL commands on the underlying database.



III. SOLUTION



   Not available currently.





IV. VENDOR FIX/RESPONSE



   Notified.





V. CREDIT



   This vulnerability was discovered by Positive Technologies using MaxPatrol

(http://www.maxpatrol.com) - intellectual professional security scanner. 

   It is able to detect a substantial amount of vulnerabilities not published

   yet. MaxPatrol's intelligent algorithms are also capable to detect a lot of

   vulnerabilities in custom web-scripts (XSS, SQL and code injections, HTTP

   Response splitting).


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH