[TKADV2005-12-001] Multiple SQL Injection vulnerabilities in MyBB
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Advisory: Multiple SQL Injection vulnerabilities in MyBB
Name: TKADV2005-12-001
Revision: 1.0
Release Date: 2005/12/23
Last Modified: 2005/12/23
Date Reported: 2005/11/07
Author: Tobias Klein (tk at trapkit.de)
Affected Software: MyBB (all versions <= MyBB PR2 Rev.686)
Risk: Critical (x) High ( ) Medium ( ) Low ( )
Vendor URL: http://www.mybboard.com/
Vendor Status: Vendor has released an updated version
=========
Overview:
=========
MyBB is a powerful, efficient and free forum package developed in
PHP and MySQL.
Version MyBB PR2 Rev.686 and prior contain multiple SQL Injection
vulnerabilities.
======================
Vulnerability details:
======================
Some of the following vulnerabilities can be successfully exploited
by every anonymous guest user of MyBB. To exploit the other issues
a registered user account is needed. Because of that all
vulnerabilities are rated with a high probability of occurrence.
Every single SQL injection issue that is described in the following
allows a full compromise of a MyBB installation (f.e. steal or
[re]set the administrator password). PoC code has been developed
but won't be released to the public.
For a description of the calculation of the resulting threat of a
vulnerability see reference [3].
[1] SQL Injection
Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical
HTTP method: POST
Vulnerability description:
MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.
Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.
This vulnerability can be successfully exploited by any anonymous
guest user of MyBB.
Vulnerable URL:
[path_to_mybb]/calendar.php?action=addevent
Vulnerable POST parameter: month
Proof of Concept (POST request):
POST [path_to_mybb]/calendar.php HTTP/1.1
Parameter | Value
--------------------------------
month | 11[SQL]
day | 11
year | 2005
subject | test
description | test
action | do_addevent
[2] SQL Injection
Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical
HTTP method: POST
Vulnerability description:
MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.
Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.
This vulnerability can be successfully exploited by any anonymous
guest user of MyBB.
Vulnerable URL:
[path_to_mybb]/calendar.php?action=addevent
Vulnerable POST parameter: day
Proof of Concept (POST request):
POST [path_to_mybb]/calendar.php HTTP/1.1
Parameter | Value
--------------------------------
month | 11
day | 11[SQL]
year | 2005
subject | test
description | test
action | do_addevent
[3] SQL Injection
Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical
HTTP method: POST
Vulnerability description:
MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.
Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.
This vulnerability can be successfully exploited by any anonymous
guest user of MyBB.
Vulnerable URL:
[path_to_mybb]/calendar.php?action=addevent
Vulnerable POST parameter: year
Proof of Concept (POST request):
POST [path_to_mybb]/calendar.php HTTP/1.1
Parameter | Value
--------------------------------
month | 11
day | 11
year | 2005[SQL]
subject | test
description | test
action | do_addevent
[4] SQL Injection
Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical
HTTP method: POST
Vulnerability description:
MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.
Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.
This vulnerability can be successfully exploited by any registered
user of MyBB.
Vulnerable URL:
[path_to_mybb]/usercp.php?action=options
Vulnerable POST parameter: threadmode
Proof of Concept (POST request):
POST [path_to_mybb]/usercp.php HTTP/1.1
Parameter | Value
--------------------------------
allownotices | yes
emailnotify | yes
receivepms | yes
pmpopup | yes
pmnotify | yes
dateformat |
timeformat |
timezoneoffset | 0
tpp |
daysprune |
ppp |
threadmode | [SQL]
showcodebuttons | 1
style | 0
language |
action | do_options
regsubmit | Update Options
[5] SQL Injection
Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical
HTTP method: POST
Vulnerability description:
MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.
Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.
This vulnerability can be successfully exploited by any registered
user of MyBB.
Vulnerable URL:
[path_to_mybb]/usercp.php?action=options
Vulnerable POST parameter: showcodebuttons
Proof of Concept (POST request):
POST [path_to_mybb]/usercp.php HTTP/1.1
Parameter | Value
--------------------------------
allownotices | yes
emailnotify | yes
receivepms | yes
pmpopup | yes
pmnotify | yes
dateformat |
timeformat |
timezoneoffset | 0
tpp |
daysprune |
ppp |
threadmode |
showcodebuttons | 1[SQL]
style | 0
language |
action | do_options
regsubmit | Update Options
[6] SQL Injection
Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical
HTTP method: POST
Vulnerability description:
MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.
Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.
This vulnerability can be successfully exploited by any registered
user of MyBB.
Vulnerable URL:
[path_to_mybb]/usercp.php?action=editlists
Vulnerable POST parameter: list
Proof of Concept (POST request):
POST [path_to_mybb]/usercp.php HTTP/1.1
Parameter | Value
--------------------------------
listuser%5B1%5D | admin
listuser%5Bnew1%5D |
listuser%5Bnew2%5D |
action | do_editlists
list | buddy[SQL]
submit | Update Buddy List
[7] SQL Injection
Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical
HTTP method: POST
Vulnerability description:
MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.
Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.
This vulnerability can be successfully exploited by any registered
user of MyBB.
Vulnerable URL:
[path_to_mybb]/member.php?action=rate&uid=1
Vulnerable POST parameter: rating
Proof of Concept (POST request):
POST [path_to_mybb]/member.php HTTP/1.1
Parameter | Value
--------------------------------
rating | 5[SQL]
action | do_rate
uid | 1
[8] SQL Injection
Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical
HTTP method: POST
Vulnerability description:
MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.
Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.
This vulnerability can be successfully exploited by any registered
user of MyBB.
Vulnerable URL:
[path_to_mybb]/showthread.php?tid=1
Vulnerable POST parameter: rating
Proof of Concept (POST request):
POST [path_to_mybb]/ratethread.php HTTP/1.1
Parameter | Value
--------------------------------
rating | 5[SQL]
tid | 1
=========
Solution:
=========
Upgrade to MyBB 1.0 or newer.
http://www.mybboard.com/downloads.php
========
History:
========
2005/11/07 - Vendor notified
2005/11/07 - Vendor response
2005/11/15 - Contacted vendor regarding status report
2005/11/16 - Vendor response
2005/12/04 - Contacted vendor regarding status report
2005/12/06 - Vendor response
2005/12/09 - Release of new MyBB version
2005/12/09 - Patch notification released
2005/12/23 - Full technical details released to general public
========
Credits:
========
Vulnerabilities found and advisory written by Tobias Klein.
===========
References:
===========
[1] http://community.mybboard.net/showthread.php?tid=5184
[2] http://www.trapkit.de/advisories/TKADV2005-12-001.txt
[3] http://www.trapkit.de/advisories/TKPN2005-12-001.txt
[4] http://www.trapkit.de/advisories/TKADVcortav.txt
========
Changes:
========
Revision 0.1 - Initial draft release to the vendor
Revision 1.0 - Public release
===========
Disclaimer:
===========
The information within this advisory may change without notice. Use
of this information constitutes acceptance for use in an AS IS
condition. There are no warranties, implied or express, with regard
to this information. In no event shall the author be liable for any
direct or indirect damages whatsoever arising out of or in connection
with the use or spread of this information. Any use of this
information is at the user's own risk.
==================
PGP Signature Key:
==================
http://www.trapkit.de/advisories/tk-advisories-signature-key.asc
Copyright 2005 Tobias Klein. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBQ6xPFZF8YHACG4RBEQJx1QCfdFspLw8epNGeZXzNLfxVcbpP4fIAoL/c
Yj40PaAEeU82FFSNBUBbtVcF
=Tb+B
-----END PGP SIGNATURE-----