Invision Power Board SQL injection

Advisory Text :

RST/GHC advisory#41
Product: Invision Power Board
Version: 2.1 <= 2.1.6
Vendor: INVISION Power Service
URL: http://www.invisionpower.com
VULNERABILITY CLASS: SQL injection

[Product Description]
Invision Power Board, an award-winning scaleable bulletin board system,
written in PHP, uses SQL database.
"Invision Power Board is packed with useful features that enable you to
quickly and painlessly configure and manage every aspect of your board."

[Summary]
Unsufficient sanitazing of the user depend data in HTTP header may lead to
SQL injection attack.

[Details]
Data from HTTP variable CLIENT_IP puts directly to sql statement:

[code] /sources/ipsclass.php
$addrs[] = $_SERVER['HTTP_CLIENT_IP'];
$addrs[] = $_SERVER['REMOTE_ADDR'];
$addrs[] = $_SERVER['HTTP_PROXY_USER'];
foreach ( $addrs as $ip )
{
if ( $ip )
{
$this->ip_address = $ip;
break;
}
}
[/code]

[code] /sources/classes/class_session.php
if ( $this->ipsclass->vars['match_ipaddress'] == 1 )
{
$query .= " AND ip_address='".$this->ipsclass->ip_address."'";
}

$this->ipsclass->DB->simple_construct(array( 'select' => 'id, member_id,
running_time, location',
'from' =>
'sessions',
'where' =>
"id='".$session_id."'".$query));
[/code]

[Exploit]
http://rst.void.ru/download/r57ipb216gui.txt

[Bugfix]
Upgrade to 2.1.7 version

[Credits]
1dt.w0lf
RST/GHC
http://rst.void.ru
http://ghc.ru

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Invision Power Board SQL injection