Re: phpBB 2.06 search.php SQL injection
An exploit has been released by bugtraq by some other group, the issue is
unfortunately not minor... As the exploit shows, the trick is to mimic a
search_array.
I was planning on releasing more technical details later, when everybody had a
chance to patch his/her forum.
About my test URL, you are absolutely right, the test url does not work. This
is
because in my original mail, the test url was:
http://your_site/phpBB2/search.php?search_id=1[backslash]
somewhere along the way, that backslash ended up just escaping the newline
character. My sincere apologies for the problems this may have caused.
Niels
zarath AT knightsofchaos DOT com wrote:
Greetings BugTraq,
I have tested this vulnerability fairly extensively since it was announced on
phpBB.com.
Even though the version I'm using clearly has the vulnerable code it in,
it does not seem to work as easily as this is being made out. My server is
running
PHP 4.3.4, and MySQL 4.0.15. The way I tested (which you didn't provide any
proof
of concept code) was through a UNION command ->
http://yourdomain/yourforums/search.php?search_id=1
UNION select `user_password` from `phpbb_users` where user_id=1/*
However, due to the fact that it uses an array function to pull all the
relative
information
and the hash returns a single value without the seperators, it won't
acknowledge that a result was returned.
If you try -> http://yourdomain/yourforums/search.php?search_id=1 or 1=1 UNION
select
`user_password` from `phpbb_users` where user_id=1/*
It will return all search results, but since it will only handle the first
returned
column and doesn't loop over them, it still won't display the password hash.
>From what I've tried so far, this doesn't really seem to be a critical
>vulnerability
-- just an SQL injection that would allow you to get maybe the prefix of the
forum tables or other insignifcant information.
The SQL injection still exists if that URL you specified
"http://your_site/phpBB2/search.php?search_id=1";
returns "No topics or posts met your search criteria", also.
A better way to test would be to mess with the query. Something like ->
http://your_site/phpBB2/search.php?search_id=1
or blah=blah if that returns a debugging
error, that means your boards are vulnerable.
Zarath