Vulnerable Systems:
* phpBB version 2.0.5 and prior
Immune Systems:
* phpBB version 2.0.6
phpBB has a list of registered users, when you click on a member of this list, you request data from the database.
Example:
http://www.example.c...viewprofile&u=2
This URL shows the information for the user with the uid = 2 (the uid is a number assigned to users in phpBB). The content of the 'u' variable isn't filtered for malicious contents.
An attacker could inject arbitrary SQL commands into the system's database.
Example:
http://www.example.com/profile.php?mode=viewprofile&u='[sqlcode]
Vendor Status:
Upgrade to version 2.0.6 of phpBB, as the version is immune to this issue.
Sponsored by: █ Sparkhost - Hosting Without Compromises! █ Hybrid Performance Web Hosting █ Spark Host Stream Hosting █ Hybrid IRC & IRCd Server Shell Accounts
Phpbb Sql Injection Exploit
Started by
boshcash
, Nov 11 2003 06:40 AM
10 replies to this topic
#2 Guest_aspfreakout_*
Guest_aspfreakout_*
-
- Guests
Posted 11 November 2003 - 11:33 AM
Seems to be limited to 25 characters 
Couldn't think of any good sql code in less than 25 characters, but maybe that's because I got this huge headache
Couldn't think of any good sql code in less than 25 characters, but maybe that's because I got this huge headache
#4
JaG
-
- Sergeant Major
-
- 209 posts
Sergeant
Posted 19 December 2003 - 11:39 PM
nice.......but does anyone have a examples of commands that can be used?
#5 Guest_Armani_*
Guest_Armani_*
-
- Guests
Posted 20 December 2003 - 12:18 PM
hmm, if it wouldn't be limited to 25 characters, it would be a cool exploit
#6 Guest_KillerLoo_*
Guest_KillerLoo_*
-
- Guests
Posted 26 February 2004 - 11:52 PM
I try it. Take a /etc/passwd. Give it 2 JTR. And have a shell from 1 user 
)) After small sniffering have a root ))) But this extremmly rare! I think its just a wonder
Love this small Japaneese admin))
)) After small sniffering have a root ))) But this extremmly rare! I think its just a wonderLove this small Japaneese admin
))
#7
kyriakosnicola
-
- Members
-
- 19 posts
Private
Posted 25 April 2004 - 04:18 AM
there's a cool script that can be injected in such a way that can retrieve you any member's password on that forum. it can even retrieve admin's password giving the attacker full access to the control panel of the forum.
i have had such an attack on my forum and the malicious attacker changed my passwords etc locking me out of my own forum.
the only good solution that exists in protecting your forum from such attacks is to get the newer version of phpbb or just moving on to a better script like invision boards like the one GSO uses.
i have had such an attack on my forum and the malicious attacker changed my passwords etc locking me out of my own forum.
the only good solution that exists in protecting your forum from such attacks is to get the newer version of phpbb or just moving on to a better script like invision boards like the one GSO uses.
#8 Guest_eckan_*
Guest_eckan_*
-
- Guests
Posted 13 June 2004 - 09:02 AM
Thats really sloppy coding from the phpbb team :/
they must of lost alot of respect for this one.
select * from users; would give you the hash of the password, no?
they must of lost alot of respect for this one.
select * from users; would give you the hash of the password, no?
#9
MasterWeb
-
- Members
-
- 28 posts
Private First Class
Posted 23 June 2004 - 01:29 PM
does anyone have a examples of commands that can be used on this version ?!
#10
[R]
-
- Members
-
- 101 posts
Specialist
Posted 25 June 2004 - 05:42 AM
yeah this sploit is very coool but i need an example too 
so, please help me
so, please help me
#11 Guest_slipped_*
Guest_slipped_*
-
- Guests
Posted 26 June 2004 - 12:11 PM
http://www.governmen...wtopic=9437&hl=
I posted this in the trial member forum I think. It is a different sql injection exploit and works with newer version.
I have provided example sql injection statements in that post.
I posted this in the trial member forum I think. It is a different sql injection exploit and works with newer version.
I have provided example sql injection statements in that post.
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
