|
MyBB 1.1.1 SQL Injections
Πολλές τρύπες στο php MyBB 1.1.1
http://www.mybboard.com/
* 1 *
[code]
adminfunctions.php , line 730
$db->query("INSERT INTO ".TABLE_PREFIX."adminlog (uid,dateline,scriptname,action,querystring,ipaddress) VALUES ('".$mybbadmin['uid']."','".$now."','".$scriptname."','".$mybb->input['action']."','".$querystring."','".$ipaddress."')");
$querystring = Not Filtered
Exploit Exm.
/admin/adminlogs.php?action=view&D3vil-0x1=[SQL]'
Fix , Replace with
$db->query("INSERT INTO ".TABLE_PREFIX."adminlog (uid,dateline,scriptname,action,querystring,ipaddress) VALUES ('".$mybbadmin['uid']."','".$now."','".$scriptname."','".$mybb->input['action']."','".addslashes($querystring)."','".$ipaddress."')");
[/code]
* 2 *
[code]
templates.php , lines 107 to 114
$newtemplate = array(
"title" => addslashes($mybb->input['title']),
"template" => addslashes($mybb->input['template']),
"sid" => $mybb->input['setid'],
"version" => $mybboard['vercode'],
"status" => "",
"dateline" => time()
);
sid = Not Filtered
Exploit Exm.
/admin/templates.php?action=do_add&title=Devil&template=Div&setid=[SQL]'
Fix Replace with
$newtemplate = array(
"title" => addslashes($mybb->input['title']),
"template" => addslashes($mybb->input['template']),
"sid" => addslashes($mybb->input['setid']),
"version" => $mybboard['vercode'],
"status" => "",
"dateline" => time()
);
[/code]
* 3 *
[code]
templates.php , line 600
$query = $db->query("SELECT * FROM ".TABLE_PREFIX."templatesets WHERE sid='".$expand."'");
$expand = $mybb->input['expand']; = Not Filtered
Exploit Exm.
/admin/templates.php?expand=' UNION ALL SELECT 1,2/*
Fix Replace With
$query = $db->query("SELECT * FROM ".TABLE_PREFIX."templatesets WHERE sid='".intval($expand)."'");
[/code]
* 4 *
[code]
templates.php , line 424
$query = $db->query("SELECT * FROM ".TABLE_PREFIX."templates WHERE title='".$mybb->input['title']."' AND sid='".$mybb->input['sid1']."'");
$template1 = $db->fetch_array($query);
$query = $db->query("SELECT * FROM ".TABLE_PREFIX."templates WHERE title='".$mybb->input['title']."' AND sid='".$mybb->input['sid2']."'");
Exploit Exm.
/admin/templates.php?action=diff&title=[SQL]'
/admin/templates.php?action=diff&sid2=[SQL]'
Fix Replace With
$query = $db->query("SELECT * FROM ".TABLE_PREFIX."templates WHERE title='".addslashes($mybb->input['title'])."' AND sid='".intval($mybb->input['sid1'])."'");
$template1 = $db->fetch_array($query);
$query = $db->query("SELECT * FROM ".TABLE_PREFIX."templates WHERE title='".addslashes(($mybb->input['title'])."' AND sid='".intval($mybb->input['sid2'])."'");
[/code]
MyBB Has Many Local Bugs ,, Fix It s00n ;)
http://seclists.org/lists/bugtraq/2006/Apr/0563.html
Από:
News-User - 28/4/2006
Καμία απάντηση | Σχολίασε | Ψήφισε η καταχώρησε σε δίκτυο social news
|
|
Αναβάθμιση τώρα σε phpAdsNew ή phpPgAds 2.0.7.
phpAdsNew / phpPgAds security advisory PHPADSNEW-SA-2005-002
------------------------------------------------------------------------
Advisory ID: PHPADSNEW-SA-2005-002
Date: 2005-Nov-15
Security risk: highly critical
Applications affetced: phpAdsNew, phpPgAds
Versions affected: <= 2.0.6
Versions not affected: >= 2.0.7
========================================================================
========================================================================
Vulnerability 1: SQL injection
------------------------------------------------------------------------
Impact: database access (+ potential system access)
Where: from remote
========================================================================
Description
-----------
Toni Koivunen reported an SQL injection vulnerablility in
phpAdsNew and phpPgAds, caused by missing sanitization of the session id
cookie. Kevin Fernandez "Siegfried" of Zone-H reported further dangerous
exploitation techniques to gain access to the whole database. Depending
on the database user permissions, an attacker could also gain
access to the local filesystem.
Solution
--------
- Upgrade to phpAdsNew or phpPgAds 2.0.7.
References
----------
http://www.fitsec.com/advisories/FS-05-01.txt
http://www.zone-h.org/en/advisories/read/id=8413/
========================================================================
Vulnerability 2: HTTP response splitting
------------------------------------------------------------------------
Impact: application admin access
Where: from remote
========================================================================
Description
-----------
Toni Koivunen reported multiple HTTP response splitting vulnerabilities
in phpAdsNew and phpPgAds. Many of them could only be made if the
attacker already has access to the administration interface. A
vulnerability adclick.php could be exploited without access to the
application interface.
Solution
--------
- Upgrade to phpAdsNew or phpPgAds 2.0.7.
References
----------
http://www.fitsec.com/
========================================================================
Vulnerability 3: full path disclosure
------------------------------------------------------------------------
Impact: information disclosure
Where: from remote
========================================================================
Description
-----------
Toni Koivunen reported multiple full path disclosure vulnerabilities in
phpAdsNew and phpPgAds. One of them could also reveal information about
files modified or added by the system administrator, using phpAdsNew's
own file integrity check system, given that the webserver user has
enough permissions.
Solution
--------
- Upgrade to phpAdsNew or phpPgAds 2.0.7.
References
----------
http://www.fitsec.com/advisories/FS-05-01.txt
Contact informations
====================
The security contact for phpAdsNew and phpPgAds can be reached at:
Best regards
--
Matteo Beccati
http://phpadsnew.com/
http://phppgads.com/
Από:
Alex - 10/4/2006
Καμία απάντηση | Σχολίασε | Ψήφισε η καταχώρησε σε δίκτυο social news
|
|
Κατεβάστε την 2.8.0.3
http://www.phpmyadmin.net/home_page/downloads.php#2.8.0.3
Details:
phpMyAdmin comes with a register_globals emulation layer within
grab_globals.php, to ensure compatibility with hosts where this
feature is turned off. This layer was heavily modified for the
release of phpMyAdmin 2.7.0. One of the major changes is, that
the blacklist of variables that may not be overwritten by the
emulation layer is now stored in a global variable.
Unfortunately the variablename $import_blacklist is not covered
by the protection and therefore it was possible for an attacker
to overwrite the blacklist. After the blacklist is overwritten
an attacker can f.e. overwrite the $GLOBALS array with arbitrary
content and therefore exploit several places where the $GLOBALS
array is used.
During normal execution this $GLOBALS array is just another way
to access global variables, but when a script overwrites it,
it becomes a normal variable, with a few exceptions in PHP4.
For more information about what unexpected things can happen
when $GLOBALS is overwritten please have a look at
http://www.hardened-php.net/globals-problem
In phpMyAdmin $GLOBALS is used f.e. in the CSS generator to
access the global variable that stores the configuration. Due
to the fact, that the content of this variable is under total
control of the attacker the path to an included file can be
injected. This leads to an remote URL include vulnerability
in PHP5 and a local file include vulnerability in PHP4.
The difference is caused by the fact, that the PHP function
file_exists() does not work on URL wrappers within PHP4, but
works on ftp:// URLs in PHP5. (When the host is running our
Hardening-Patch for PHP such a remote URL inclusion is of
course not allowed and logged).
Please also note that there are multiple (easy) ways to
get PHP code into files on the server, so that local file
inclusion vulnerabilities are more dangerous than they seem.
Additionally it is possible to directly include PEAR.php
from the installed PHP distribution. If it is one that
was shipped with PHP <= 4.3.10 this can be used to directly
execute code on the server by manipulating the destructor
list.
There are other places in phpMyAdmin, where this vulnerability
can lead to XSS and other local file inclusion vulnerabilities.
Those will not be listed separately, because the problem
mentioned above is already serious enough to demonstrate the
impact of the failing overwrite protection.
Proof of Concept:
The Hardened-PHP project is not going to release exploits for
this vulnerability to the public.
Disclosure Timeline:
6. December 2005 - Disclosed vulnerability to vendor
7. December 2005 - Release of new phpMyAdmin version
7. December 2005 - Public Disclosure
Recommendation:
It is strongly recommended to upgrade to the new version of
phpMyAdmin which you can download at:
http://www.phpmyadmin.net/home_page/downloads.php
http://www.hardened-php.net/advisory_252005.110.html
Από:
Alex - 10/4/2006
1 απαντήσεις | Σχολίασε | Ψήφισε η καταχώρησε σε δίκτυο social news
|
Security News :: Θέματα
Πολλές τρύπες στο php MyBB 1.1.1