Multiple Sql Injection in vBulletin 3.7.4

[kan3]

[waraxe-2008-SA#069] - Multiple Sql Injection in vBulletin 3.7.4
===============================================================================

Author: Janek Vind "waraxe"
Date: 17. November 2008
Location: Estonia, Tartu
Web: [waraxe-2008-SA#069] - Multiple Sql Injection in vBulletin 3.7.4


Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

vBulletin (abbreviated as vB) is a commercial Internet forum software produced
by Jelsoft Enterprises. It is written in PHP using a MySQL database server.
vBulletin is a professional, affordable community forum solution. Thousands of
clients, including many industry leading blue chip companies, have chosen
vBulletin - It's the ideal choice for any size of community.

Web: vBulletin - Instant Community


List of found vulnerabilities
===============================================================================

1. Sql Injection in "admincp/verify.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Impact: low
Preconditions: attacker must have admin account with Human Verification Manager
administer privileges


[---------- source code snippet start ----------]
if ($_POST['do'] == 'updateanswer')
{
$vbulletin->input->clean_array_gpc('p', array(
'answer' => TYPE_STR,
));
..
$db->query_write("
UPDATE " . TABLE_PREFIX . "hvanswer
SET answer = '" . $vbulletin->GPC['answer'] . "'
WHERE answerid = " . $vbulletin->GPC['answerid']
);
[----------- source code snippet end -----------]

It appears, that user submitted parameter "answer" is not properly sanitized
before using in sql query. As result sql injection is possible. Test will
induce sql error message:

Invalid SQL:
UPDATE vb_hvanswer
SET answer = 'war'axe'
WHERE answerid = 1;


2. Sql Injection in "admincp/attachmentpermission.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Impact: low
Preconditions: attacker must have admin account with Attachment Permissions
Manager administer privileges

As in previous case, user submitted parameter, this time it's "extension", is
used in sql query without proper snaitization. This results sql injection
vulnerability. For test log in as admin with needed privileges and then issue
GET request (using proper URI instead if example):

http://localhost/vbulletin374/admincp/attachmentpermission.php?do=edit&extension=war'axe

This results with error message from vBulletin:

Database error in vBulletin 3.7.4:
Invalid SQL:

SELECT size, width, height
FROM attachmenttype
WHERE extension = 'war'axe';


3. Sql Injection in "admincp/image.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Impact: low
Preconditions: attacker must have admin account with Avatars administer privileges

[---------- source code snippet start ----------]
if ($_POST['do'] == 'updatepermissions')
{
$vbulletin->input->clean_array_gpc('p', array(
'iperm' => TYPE_ARRAY,
'imagecategoryid' => TYPE_INT
));
..
foreach($vbulletin->GPC['iperm'] AS $usergroupid => $canuse)
{
if ($canuse == 0)
{
$db->query_write("
INSERT INTO " . TABLE_PREFIX . "imagecategorypermission
(
imagecategoryid,
usergroupid
)
VALUES
(
" . $vbulletin->GPC['imagecategoryid'] . ",
$usergroupid
)
[----------- source code snippet end -----------]

User-submitted array "iperm" is used in sql query without proper sanitization.
This results in sql injection. Testing ends with error message:

MySQL Error : Unknown column 'waraxe' in 'field list'

 

[bluescorpion]

And your point would be what?

 

[kan3]

Do you see any point there? If no, then there aint no point.

 

[kan3]

I think 3.7.4 PL1 has been fixed, what do you think?

 

[Filez]

kan3 yes PL1 fixed the issues

 

[Grinderhand]

Seems to me if someone had admin privileges, they could do a whole lot more than sql injection. Kind of a non-issue.

 

[bluescorpion]

Seems to me if someone had admin privileges, they could do a whole lot more than sql injection. Kind of a non-issue.

DUH-Yeah!

Sql injection would probably not even be on the list of worries in that case, LOL

That was actually the motive for my first post on this thread. All of that exploits described seemed to require admincp access, trashing the system is a pretty simple matter and sql injection would not be on a hackers list of "things to do". Injections, to me, only matter when you can do them from "outside" the script, like through a form or query, that you don't need any permissions to execute. Those are the ones that wreak havoc on site as far as I am concerned not the obscure ones that require admin privileges.

 

[shaun166]

DUH-Yeah!

Sql injection would probably not even be on the list of worries in that case, LOL

That was actually the motive for my first post on this thread. All of that exploits described seemed to require admincp access, trashing the system is a pretty simple matter and sql injection would not be on a hackers list of "things to do". Injections, to me, only matter when you can do them from "outside" the script, like through a form or query, that you don't need any permissions to execute. Those are the ones that wreak havoc on site as far as I am concerned not the obscure ones that require admin privileges.

LOL at this. and yea sql injection not even be on the list of worries. lol i laugh like hell when i saw this