Re: [Full-Disclosure] OpenBB 1.06 SQL Injection

[gr00vy <groovy2600@yahoo.com.ar>]

Also there are XSS vuln and may be SQL injection (i did not test it):

http://forums.openbb.com/board.php?FID=%3Cscript%3Ealert(document.cookie)%3C/script%3E

On Fri, 2003-12-26 at 17:38, n.teusink@planet.nl wrote:
> Hello full-disclosure readers,
> 
> A vulnerability exists in OpenBB 1.06 that could allow an attacker to 
> manipulate SQL 
> queries and obtain sensitive information from the database such as 
> the administrator 
> md5 password hash. 
> This vulnerability exists because the index.php script of the 
> application does not 
> sufficiently sanitize the input of the "CID" parameter.
> 
> As far as I know this vulnerability can only be exploited if the 
> database server the 
> forum uses supports the UNION keyword, so it is probably not 
> exploitable with 
> MySQL 3.x. I have succesfully exploited this issue when using 
> MySQL 4 as the 
> database server.
> 
> Impact
> ------
> 
> If the admin password is weak enough the attacker could crack it 
> using a brute force 
> password cracker on the hash and get full control over the forum.
> 
> Solution
> --------
> 
> I have notified the OpenBB developers and they have very quickly (a 
> couple of hours, 
> great work guys!) released a patched version. You can also patch 
> your forum 
> manually as described in the OpenBB advisory: 
> http://forums.openbb.com/read.php?TID=445
> 
> 
> Cheers,
> 
> Niels Teusink
> 
> http://www.teusink.net
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html