Sign in to follow this  
Followers 0
~bWM

[bWM#015]

1 post in this topic

badWebMasters security advisory #015

SQL-Injection @ Woltlab Burning Board + MOD Guthabenhack 1.3

Discovery date: 2003-07-28

Original advisory:

http://badwebmasters.net/advisory/015/ (text/html)

Legal Notice:

Copyright 2003 by Benjamin Klimmek (ben moeckel - badWebMasters)!

You may distribute it unmodified.

You may not modify it and distribute it or distribute parts of it without giving credits and the URL where the original advisory can be found!

This document may change without notice.

Author:

ben moeckel (http://distressed.de)

mailto: badwebmasters@online.de

Description:

With the "Guthaben hack" (that includes Zwerg's "User Werben Hack" 3.0) for Woltlab Burning Board you can get credits for promoting new members. The new user may add the promoter's ID into the registration form, so he can get his credits.

Due to an input validation bug the "User Werben"-MOD is vulnerable to an sql-injection attack. This makes it possible for an malicious user to gain admin rights.

Exploit:

The field got a maxlength-value of 10, so the attacker may use IE + javascript to inject the sql-string:

java script:x=document.forms[0].geworbenv;x.value=", groupid=1";alert(x.value);

Vendor:

Vendor has been contacted by php-masta, no reply received.

Thanks:

php-masta (php-masta.net) for inviting me to join his board ;)

Feedback:

Comments, suggestions, updates, anything else?

-> mailto:badwebmasters@online.de

--------------------------------------------------------------------------------

badWebMasters

ben moeckel security research

copyright 2k1-3 by Benjamin Klimmek / Germany.

mailto:badwebmasters@online.de

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0