--------------------- SUMMARY ---------------------
Name:
XennoBB "icon_topic" SQL Injection (19/8/2006)
Vendor / Product:
XennoBB Group
http://www.xennobb.com/
Description:
The world's most revolutionary and easy to use bulletin board.
Revolutionary because it redefines the boundaries of usability
and power; from the first version it's a real alternative to
the commercial forums out there.
How can XennoBB be described in few words?
Lightning-speed, stable, SECURED(?) and modern.
Version(s) Affected:
All current (<= 2.2.1 at the time of the release)
Severity:
High
Impact:
SQL Injection (Remote)
Status:
Unpatched
Discovered by:
Chris Boulton <http://www.surfionline.com>
Original advisory:
http://www.surfionline.com/security_advisories/20060819_xennobb_icon_top
ic_sql.txt
------------------- DESCRIPTION -------------------
An exploit exists in the above mentioned versions of XennoBB which
can be exploited by malicious users to conduct SQL injection attacks.
Input passed to the "icon_topic" parameter in topic_post.php is not
properly sanitised before being used in an SQL query. This exploit
can lead to manipulation of SQL queries by injecting arbitary SQL code.
--------------------- EXPLOIT ---------------------
Submit a forged POST request to
topic_post.php?action=post&fid={forum ID here}
With the following as the POST data:
form_sent=1&form_user={username here}&req_subject=Subject&req_message=Message&submit=1&icon_topic=[SQL]
Successful exploitation leads would lead to the SQL query in the icon_topic
parameter being run.
--------------------- SOLUTION --------------------
Ensure input is properly sanitized before being used in a database
query.
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum