If you have found a vulnerability, please send to our SecurityAlert Database : secalert()securityreason()com
Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive : exploit()securityreason()com
Details : SecurityReason Advisory
Topic : phpBB 2.0.18 SQL Query problem SecurityAlert : 26 SecurityRisk : Low (About) Remote Exploit : Yes Local Exploit : No Exploit Given : Yes Credit : Maksymilian Arciemowicz Date : 11.11.2005
Affected Software :
phpBB2 x <= 2.0.18
Advisory Text :
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[phpBB 2.0.18 SQL Query problem cXIb8O3.19]
Author: Maksymilian Arciemowicz (cXIb8O3)
Date: 11.11.2005
from securityreason.com TEAM
- --- 0.Description ---
phpBB is a high powered, fully scalable, and highly customizable Open
Source bulletin boar
d package. phpBB has a user-friendly interface, simple and straightforward
administration
panel, and helpful FAQ. Based on the powerful PHP server language and your
choice of MySQL
, MS-SQL, PostgreSQL or Access/ODBC database servers, phpBB is the ideal
free community so
lution for all web sites.
Contact with author http://www.phpbb.com/about.php.
- --- 1. * SQL query problem ---
phpBB2 don't check size of sql query. So we can send any data in all post
variables.
Standart Environment:
post_max_size=8M (standart)
max_allowed_packet < 7M (1M standart in mysql)
Example Evironment:
memory_limit>8MB
max_execution_time=30
max_allowed_packet=1M
I have written simple request where one variable POST to sql query was 1M.
- ---output1---
Could not obtain matched posts list
DEBUG MODE
SQL Error : 1153 Got a packet bigger than 'max_allowed_packet'
SELECT m.post_id FROM phpbb_search_wordlist w, phpbb_search_wordmatch m
WHERE w.word_text LIKE 'securityreasoncomsecurityreasoncom...' AND
m.word_id = w.word_id AND w.word_common <> 1 AND m.title_match = 0
Line : 321
File : search.php
- ---/output1---
sql error.
or when you have:
memory_limit=8MB
or
max_execution_time<30
display_error=1
You can see in output example:
- ---output2---
Fatal error: Maximum execution time of 15 seconds exceeded in
/www/2018/phpBB2/includes/functions_search.php on line 72
- ---/output2---
- ---output3---
Fatal error: Allowed memory size of 8388608 bytes exhausted (tried to
allocate 1746401 bytes) in /www/2018/phpBB2/includes/functions_search.php
on line 27
- ---/output3---
Microsoft Device IO Control wrapped by the iphlpapi.dll API shipping with Windows Vista 32 bit and 64 bit contains a possibly exploitable, buffer overflow corrupting kernel memory.