Re: Possible phpBB <=2.0.11 bug or sql injection?

From: kaosone+[ONE]+ (kaosone_at_gmail.com)
Date: 02/19/05

  • Next message: unmanarc: "Re: Combining Hashes" 
    Date: Sat, 19 Feb 2005 13:29:41 +0100
To: bugtraq@securityfocus.com

    On 17 Feb 2005 09:54:57 -0000, jtm297@optonline.net
    <jtm297@optonline.net> wrote:
    >
    > It seems it has something to do with the the \'s *'s and length. I am not sure if this is a big bug but I decided to try that after looking at search.php

    look at

    function phpbb_clean_username($username)
    {
            $username = htmlspecialchars(rtrim(trim($username), "\\"));
            $username = substr(str_replace("\\'", "'", $username), 0, 25);
            $username = str_replace("'", "\\'", $username);

            return $username;
    }

    the problem is in the substr;
    take for exemple phpbb_clean_username("aaaaaaaaaaaaaaaaaaaaaaaa\a")

    $username = htmlspecialchars(rtrim(trim($username), "\\"));
    // username not changed aaaaaaaaaaaaaaaaaaaaaaaa\a
    $username = substr(str_replace("\\'", "'", $username), 0, 25);
    // username become aaaaaaaaaaaaaaaaaaaaaaaa\

    and the query become

    SELECT user_id FROM phpbb_users WHERE username LIKE 'aaaaaaaaaaaaaaaaaaaaaaaa\'
    (notice the last ' escaped)

    a quick fix is to add $username = rtrim($username, "\\") before the
    function returns

  • Next message: unmanarc: "Re: Combining Hashes"

    Relevant Pages

    • Re: Oracle SQL Injection vulnerability
      ... The SELECT query doesn't seem to be the one you are injecting since ... likely what you put as a username is stored in a session object and is ... username field and injecting the password field with: ...
      (Pen-Test)
    • RE: How to evade white spaces in a SQL injection
      ... The 2nd one is more likely since they're proably adding the ' character to ... So you'd enter '+1-- as the username. ... +1 tells sql to add 1 to a character field, which it can't do, the -- ... comments out the remainder of the query so it doesn't get parsed. ...
      (Pen-Test)
    • RE: Conditional display of records ...
      ... So in my query, I will map 'A' and 'B' for flag='Y' and userid (with which ... users logon) with the userid stored in table 'B'. ... The trick is to create a function that calls the username function and pass ... Function CheckFlag(strFlag As String) As Boolean ...
      (microsoft.public.access.formscoding)
    • RE: Conditional display of records ...
      ... So in my query, I will map 'A' and 'B' for flag='Y' and userid (with which ... users logon) with the userid stored in table 'B'. ... The trick is to create a function that calls the username function and pass ... Function CheckFlag(strFlag As String) As Boolean ...
      (microsoft.public.access.formscoding)
    • Append/copy calling a module switches data
      ... I've taken the SQL from the previous posting (graciously ... When I run the query just by itself it does create a copy and put "dlongton" ... leaving the UserName in the original record as it was ... CreatedBy) in the original record and the newly copied record...it's driving ...
      (microsoft.public.access.queries)