 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| |
|
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9145
 People Online:
 Visitors: 631
 Members: 0
 Total: 631
|
|
|
|
|
|
PacketStorm News |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
MercuryBoard v1.1.2 |
|
 Posted: Mon Feb 28, 2005 1:50 am |
 |
|
| DoctorGrim |
| Beginner |
 |
| |
| Joined: Feb 28, 2005 |
| Posts: 1 |
|
|
|
 |
|
 |
|
Hey all, im new. Just found a vuln and sent it to Secunia, heres the report:
The Message Board System 'MercuryBoard' is vulnerable to both script
injection and a possible but not proven SQL injection, it is also
vulnerable to the viewing of the names of databases and tables.
---
Version: v1.1.2
---
Vendor has not yet been contacted
---
Vulnerability One: Script Injection:
The following requires you to register a regular user account to
execute the attack. This vulnerability is on the Control Panel page,
which allows logged in users to edit there accounts. The vulnerability
is seen when you edit/change your avatar via URL. If you change the
URL
input to
====Copy====
'><whatever code you want to inject(php or HTML or script)> .jpg
====Copy====
So basically if you always have the end as .jpg, it will accept the
code and display it as your avatar with the noavatar image next to it.
---
Vulnerability Number Two: Not Proven SQL Injection:
The following does not require an account. If you go to the url
==(with quotes)
http://host/folder/index.php?a=forum&f=''
==
It will display an SQL error. Possibly a point for SQL injection if
the code is placed right.
--
vuln three: Discovery of Database and Table names:
First of all, do vuln number 2, and at the bottom, you will see two
urls, click the one that says View Debug Information (advanced) and it
will give you a plethora of information. Like queries and etc... and
it will sometimes display your own hash on the page.
Shouts to Kookie and Danneh
http://discreetsys.com
--From Doctor Grim |
|
|
|
|
|
|
Blind SQL-Injection |
|
| Posted: Mon Feb 28, 2005 8:35 am |
|
|
| Zeelock |
| Active user |
 |
| |
| Joined: Jan 27, 2005 |
| Posts: 29 |
| Location: Where stars come out at night |
|
|
|
|
|
|
I already have made a template-tutorial for blind injection in MercuryBoard.
Anyway this is not a Select, it's a replace.
You can change the active item:
| Code: | You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '\'\', 1109580098, '129.42.208.182', 'Mozilla/4.0 (compatible; M
--------------------------------------------------------------------------------
Query Error [1064]:
This type of error is reported by MySQL.
Query:
REPLACE INTO mb_active (active_id, active_action, active_item, active_time, active_ip, active_user_agent, active_session) VALUES (1, 'forum', \'\', 1109580098, '129.42.208.182', 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705)', '073ada438efe3222da9d75033b3ab5d1') |
You can make big Denial Of services cause the Replace is a High Priority function.
Big Denial of service
http://host/folder/index.php?a=forum&f=BENCHMARK(999999999999999999999999999,MD5(CHAR(1))) |
|
Last edited by Zeelock on Mon Feb 28, 2005 11:56 am; edited 1 time in total
_________________
If it seems to be impossible, just step up your level! |
|
|
|
|
|
|
|
| Posted: Mon Feb 28, 2005 9:14 am |
|
|
| Zeelock |
| Active user |
|
| |
| Joined: Jan 27, 2005 |
| Posts: 29 |
| Location: Where stars come out at night |
|
|
|
|
|
|
For the code injection you need to have Magic Quotes disabled. If you have the protection On, you should be safe
To fix the sql Injection Change:
| Code: | if (!$mercury->perms->is_guest) {
$mercury->db->query("REPLACE INTO {$mercury->pre}active (active_id, active_action, active_item, active_time, active_ip, active_user_agent, active_session) VALUES ({$mercury->user['user_id']}, '{$mercury->get['a']}', $item, $mercury->time, '$mercury->ip', '$mercury->agent', '{$mercury->session['id']}')");
$NewMessages = $mercury->get_messages(); |
Change the the $item with '$item' (between quotes).
This problem occours for each action. |
|
_________________
If it seems to be impossible, just step up your level! |
|
|
|
|
www.waraxe.us Forum Index -> All other software
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
