General Chat
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Codewalkers Forums > General > General Chat
Reload this Page

Security Alert: phpbb flaw

Discuss Security Alert: phpbb flaw in the General Chat forum on Codewalkers.
Security Alert: phpbb flaw A place to chit-chat.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Codewalkers Forums Sponsor:
  #1  
Old March 27th, 2004, 12:45 PM
nawlej nawlej is offline
Contributing User
Codewalkers Regular (2000 - 2499 posts)
  
Join Date: Apr 2007
Location: Dallas, Tx. USA
Posts: 2,008 nawlej User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 11 h 7 m 51 sec
Reputation Power: 4
Security Alert: phpbb flaw
This showed up on Mr. Mitnicks RSS feed and I thought it applied here.

http://www.securitytracker.com/alerts/2004/Mar/1009563.html


It allows you to inject sql via the private messaging feature. NO workaround has been found.....BUT I found a way to keep it from happening until a fix has been implemented. If you disable private messaging, it cuts off the ability to use that page, and returns a "Private Messaging has been disabled on this board" message.

Just thought ya'll running PHPBB should know....
Reply With Quote
  #2  
Old March 27th, 2004, 08:09 PM
nawlej nawlej is offline
Contributing User
Codewalkers Regular (2000 - 2499 posts)
  
Join Date: Apr 2007
Location: Dallas, Tx. USA
Posts: 2,008 nawlej User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 11 h 7 m 51 sec
Reputation Power: 4
RE: Security Alert: phpbb flaw
Here is the fix:

find this part of the code in the privmsg.php file:

php Code:
Original - php Code 
  1.  
  2.        case 'savebox':
  3.           $l_box_name = $lang['Savebox'];
  4. -         $pm_sql_user .= "AND ( ( pm.privmsgs_to_userid = " . $userdata['user_id'] . "


the $pm_sql_user .= is the offending code that is allowing the attack.

Replace it with this:

php Code:
Original - php Code 
  1.  
  2.             $pm_sql_user = "AND ( ( pm.privmsgs_to_userid = " . $userdata['user_id'] . "
  3.                 AND pm.privmsgs_type = " . PRIVMSGS_SAVED_IN_MAIL . " ) 
  4.              OR ( pm.privmsgs_from_userid = " . $userdata['user_id'] . "
  5.                 AND pm.privmsgs_type = " . PRIVMSGS_SAVED_OUT_MAIL . " ) 


Thanks to Janek Vind for finding this exploit.
Reply With Quote
  #3  
Old March 28th, 2004, 03:50 PM
Anonymous Anonymous is offline
Registered User
Codewalkers God 35th Plane (22000 - 22499 posts)
  
Join Date: Apr 2007
Posts: 22,309 Anonymous User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 24
RE: Security Alert: phpbb flaw
Thanks Nawlej,

They had this fixed in 2.0.7, guess they forgot to fix in the new release.
Reply With Quote
  #4  
Old March 28th, 2004, 06:21 PM
Andrew's Avatar
Andrew Andrew is offline
Moderator
Click here for more information
 
Join Date: Apr 2007
Location: United Kingdom
Posts: 1,942 Andrew User rank is Private First Class (20 - 50 Reputation Level)Andrew User rank is Private First Class (20 - 50 Reputation Level)  Folding Points: 2429 Folding Title: Novice Folder
Time spent in forums: 4 Days 4 h 4 m 34 sec
Reputation Power: 3
Orkut
RE: Security Alert: phpbb flaw
so does that mean if you put:
php Code:
Original - php Code 
  1. $pm_sql_user = "then some sql";

It would run the sql???
Reply With Quote
  #5  
Old March 29th, 2004, 02:00 AM
nawlej nawlej is offline
Contributing User
Codewalkers Regular (2000 - 2499 posts)
  
Join Date: Apr 2007
Location: Dallas, Tx. USA
Posts: 2,008 nawlej User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 11 h 7 m 51 sec
Reputation Power: 4
RE: Security Alert: phpbb flaw
no, the way it was set up: $pm_sql_user .=

Would allow you to append sql via te input boxes in the private message form.
Reply With Quote
  #6  
Old March 29th, 2004, 05:30 AM
Andrew's Avatar
Andrew Andrew is offline
Moderator
Click here for more information
 
Join Date: Apr 2007
Location: United Kingdom
Posts: 1,942 Andrew User rank is Private First Class (20 - 50 Reputation Level)Andrew User rank is Private First Class (20 - 50 Reputation Level)  Folding Points: 2429 Folding Title: Novice Folder
Time spent in forums: 4 Days 4 h 4 m 34 sec
Reputation Power: 3
Orkut
RE: Security Alert: phpbb flaw
scary..... i tried appending a query to promote a user called Guest to Administrator and it didnt work so i must have installed the patch.
Reply With Quote
  #7  
Old March 29th, 2004, 02:30 PM
nawlej nawlej is offline
Contributing User
Codewalkers Regular (2000 - 2499 posts)
  
Join Date: Apr 2007
Location: Dallas, Tx. USA
Posts: 2,008 nawlej User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 11 h 7 m 51 sec
Reputation Power: 4
RE: Security Alert: phpbb flaw
It all depends, what version of the BB are you using? Its fixed in .07 BUT, is a problem in .08
Reply With Quote
Reply

Viewing: Codewalkers Forums > General > General Chat > Security Alert: phpbb flaw

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 6 hosted by Hostway.