[TKADV2005-12-001] Multiple SQL Injection vulnerabilities in MyBB




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Advisory: Multiple SQL Injection vulnerabilities in MyBB
Name: TKADV2005-12-001
Revision: 1.0
Release Date: 2005/12/23
Last Modified: 2005/12/23
Date Reported: 2005/11/07
Author: Tobias Klein (tk at trapkit.de)
Affected Software: MyBB (all versions <= MyBB PR2 Rev.686)
Risk: Critical (x) High ( ) Medium ( ) Low ( )
Vendor URL: http://www.mybboard.com/
Vendor Status: Vendor has released an updated version


=========
Overview:
=========

MyBB is a powerful, efficient and free forum package developed in
PHP and MySQL.

Version MyBB PR2 Rev.686 and prior contain multiple SQL Injection
vulnerabilities.


======================
Vulnerability details:
======================

Some of the following vulnerabilities can be successfully exploited
by every anonymous guest user of MyBB. To exploit the other issues
a registered user account is needed. Because of that all
vulnerabilities are rated with a high probability of occurrence.

Every single SQL injection issue that is described in the following
allows a full compromise of a MyBB installation (f.e. steal or
[re]set the administrator password). PoC code has been developed
but won't be released to the public.

For a description of the calculation of the resulting threat of a
vulnerability see reference [3].


[1] SQL Injection

Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical

HTTP method: POST

Vulnerability description:

MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

This vulnerability can be successfully exploited by any anonymous
guest user of MyBB.

Vulnerable URL:

[path_to_mybb]/calendar.php?action=addevent

Vulnerable POST parameter: month

Proof of Concept (POST request):

POST [path_to_mybb]/calendar.php HTTP/1.1

Parameter | Value
--------------------------------
month | 11[SQL]
day | 11
year | 2005
subject | test
description | test
action | do_addevent


[2] SQL Injection

Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical

HTTP method: POST

Vulnerability description:

MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

This vulnerability can be successfully exploited by any anonymous
guest user of MyBB.

Vulnerable URL:

[path_to_mybb]/calendar.php?action=addevent

Vulnerable POST parameter: day

Proof of Concept (POST request):

POST [path_to_mybb]/calendar.php HTTP/1.1

Parameter | Value
--------------------------------
month | 11
day | 11[SQL]
year | 2005
subject | test
description | test
action | do_addevent


[3] SQL Injection

Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical

HTTP method: POST

Vulnerability description:

MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

This vulnerability can be successfully exploited by any anonymous
guest user of MyBB.

Vulnerable URL:

[path_to_mybb]/calendar.php?action=addevent

Vulnerable POST parameter: year

Proof of Concept (POST request):

POST [path_to_mybb]/calendar.php HTTP/1.1

Parameter | Value
--------------------------------
month | 11
day | 11
year | 2005[SQL]
subject | test
description | test
action | do_addevent


[4] SQL Injection

Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical

HTTP method: POST

Vulnerability description:

MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

This vulnerability can be successfully exploited by any registered
user of MyBB.

Vulnerable URL:

[path_to_mybb]/usercp.php?action=options

Vulnerable POST parameter: threadmode

Proof of Concept (POST request):

POST [path_to_mybb]/usercp.php HTTP/1.1

Parameter | Value
--------------------------------
allownotices | yes
emailnotify | yes
receivepms | yes
pmpopup | yes
pmnotify | yes
dateformat |
timeformat |
timezoneoffset | 0
tpp |
daysprune |
ppp |
threadmode | [SQL]
showcodebuttons | 1
style | 0
language |
action | do_options
regsubmit | Update Options


[5] SQL Injection

Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical

HTTP method: POST

Vulnerability description:

MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

This vulnerability can be successfully exploited by any registered
user of MyBB.

Vulnerable URL:

[path_to_mybb]/usercp.php?action=options

Vulnerable POST parameter: showcodebuttons

Proof of Concept (POST request):

POST [path_to_mybb]/usercp.php HTTP/1.1

Parameter | Value
--------------------------------
allownotices | yes
emailnotify | yes
receivepms | yes
pmpopup | yes
pmnotify | yes
dateformat |
timeformat |
timezoneoffset | 0
tpp |
daysprune |
ppp |
threadmode |
showcodebuttons | 1[SQL]
style | 0
language |
action | do_options
regsubmit | Update Options


[6] SQL Injection

Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical

HTTP method: POST

Vulnerability description:

MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

This vulnerability can be successfully exploited by any registered
user of MyBB.

Vulnerable URL:

[path_to_mybb]/usercp.php?action=editlists

Vulnerable POST parameter: list

Proof of Concept (POST request):

POST [path_to_mybb]/usercp.php HTTP/1.1

Parameter | Value
--------------------------------
listuser%5B1%5D | admin
listuser%5Bnew1%5D |
listuser%5Bnew2%5D |
action | do_editlists
list | buddy[SQL]
submit | Update Buddy List


[7] SQL Injection

Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical

HTTP method: POST

Vulnerability description:

MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

This vulnerability can be successfully exploited by any registered
user of MyBB.

Vulnerable URL:

[path_to_mybb]/member.php?action=rate&uid=1

Vulnerable POST parameter: rating

Proof of Concept (POST request):

POST [path_to_mybb]/member.php HTTP/1.1

Parameter | Value
--------------------------------
rating | 5[SQL]
action | do_rate
uid | 1


[8] SQL Injection

Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical

HTTP method: POST

Vulnerability description:

MyBB is prone to a SQL injection vulnerability. This issue is due
to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

This vulnerability can be successfully exploited by any registered
user of MyBB.

Vulnerable URL:

[path_to_mybb]/showthread.php?tid=1

Vulnerable POST parameter: rating

Proof of Concept (POST request):

POST [path_to_mybb]/ratethread.php HTTP/1.1

Parameter | Value
--------------------------------
rating | 5[SQL]
tid | 1


=========
Solution:
=========

Upgrade to MyBB 1.0 or newer.

http://www.mybboard.com/downloads.php


========
History:
========

2005/11/07 - Vendor notified
2005/11/07 - Vendor response
2005/11/15 - Contacted vendor regarding status report
2005/11/16 - Vendor response
2005/12/04 - Contacted vendor regarding status report
2005/12/06 - Vendor response
2005/12/09 - Release of new MyBB version
2005/12/09 - Patch notification released
2005/12/23 - Full technical details released to general public


========
Credits:
========

Vulnerabilities found and advisory written by Tobias Klein.


===========
References:
===========

[1] http://community.mybboard.net/showthread.php?tid=5184
[2] http://www.trapkit.de/advisories/TKADV2005-12-001.txt
[3] http://www.trapkit.de/advisories/TKPN2005-12-001.txt
[4] http://www.trapkit.de/advisories/TKADVcortav.txt


========
Changes:
========

Revision 0.1 - Initial draft release to the vendor
Revision 1.0 - Public release


===========
Disclaimer:
===========

The information within this advisory may change without notice. Use
of this information constitutes acceptance for use in an AS IS
condition. There are no warranties, implied or express, with regard
to this information. In no event shall the author be liable for any
direct or indirect damages whatsoever arising out of or in connection
with the use or spread of this information. Any use of this
information is at the user's own risk.


==================
PGP Signature Key:
==================

http://www.trapkit.de/advisories/tk-advisories-signature-key.asc


Copyright 2005 Tobias Klein. All rights reserved.


-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQ6xPFZF8YHACG4RBEQJx1QCfdFspLw8epNGeZXzNLfxVcbpP4fIAoL/c
Yj40PaAEeU82FFSNBUBbtVcF
=Tb+B
-----END PGP SIGNATURE-----



Relevant Pages