[35250] in bugtraq
Re: Multiple Vulnerabilities in Invision Power Board v1.3.1 Final.
daemon@ATHENA.MIT.EDU (Hillel Himovich)
Fri Jun 11 15:00:06 2004
Date: 11 Jun 2004 15:53:13 -0000
Message-ID: <20040611155313.18926.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Hillel Himovich <hll@netvision.net.il>
To: bugtraq@securityfocus.com
In-Reply-To: <000d01c44d68$51a14ec0$05a0968c@p42800mhz>
>Compromise: SQL Injection, Cross site Scripting.
>Vulnerable Systems: Invision Power Board v1.3.1 Final.
>Details:
>An Input Validation Error exists in ssi.php.
>
>$sql_fields is vulnerable to An Input Validation Error.
>How to exploit this bug?
>http://TARGET/ssi.php?a=out&type=xml&f=0)[SQL-INJECTION]
I guss, you are reffering this line in the SQL Statment...
WHERE t.forum_id IN ($sql_fields)
I downloaded IPB 1.3.1 F and digiid for a fwe seconds, if you look a bit up in the code u'll see:
$f = intval($f);
if ( $f )
{
$forums[] = $f;
}
...........
...........
$sql_fields = implode( ",", $forums );
intval, means that u can't enter string in the f field...
