/-----------------------------------------------------------------------------\
|                             7 A 6 9 - A d v                          C: 008
|-----------------------------------------------------------------------------|
|
|                     [ SQL injection on OpenBB forums ]
|
\-----------------------------------------------------------------------------/
                                                                | 22/04/2003 |
                                                                \------------/

Data.
-----

        + Typo:         SQL injection

        + Software:     OpenBB.

        + Verions:      1.1.0 (curent version).

        + Exploit:      Yes.

        + Autor:        Albert Puigsech Galicia

        + Contact:      ripe@7a69ezine.org




Introduction.
-------------

        OpenBB is a complet forum writen in PHP language, that uses MySQL
database. More information about this software can be readed on openBB oficial
website; http://www.openbb.co.uk.


Description.
------------

        There are multiple SQL injection vulnerabilities on OpenBB's current
version.

        All PHP scripts that makes an SQL query, including numeric value
introduced by web user allow to inject our own SQL code inside.



Explotation.
------------

        Is posible, as in other similar cases of SQL injection, to extract
information from database. If vulnerable host are using MySQL 3 we must to
use LIKE method(*), but if MySQL's version 4 are used we are allowed to use
UNION, that make exploit more easy.

        To exploit this vulnerability only need to add an space (or %20)
behind the number, and next our SQL alteration.

        Some examples of this SQL injection on OpenBB may be this. The
examples contains the url to exploit it and the SQL query done (look at
'<something>', that it's our own SQL code):


        http://vulnerable/index.php?CID=1 <something>

        SELECT guest, forumid, title, lastthread, lastposter, lastposterid,
        lastthreadid, lastpost, moderators, description, type, postcount,
        threadcount, forumkey FROM obb_forum_display WHERE
	parent = 3 <something> ORDER BY displayorder


        http://vulnerable/board.php?FID=2 <something>

        SELECT title, threadcount, type, hidden_topics, forumkey FROM
        obb_forum_display WHERE forumid = 2 <something>


        http://vulnerable/member.php?action=profile&UID=1 <something>

        SELECT * FROM obb_customvalues v INNER JOIN obb_custompermis p ON
        p.fieldid = v.fieldid INNER JOIN obb_customfields f on
        f.fieldid=v.fieldid WHERE v.userid=1 <something> AND
	p.canviewothers='t' AND p.groupid='0'



Patch.
------

        There is no a patch yet, but the problem is solved if you put inverted
commas on every number variable included on SQL query or check if the variable
is realy a number.


--
>====================================
> Albert Puigsech Galicia (7a69)
>
> http://ripe.7a69ezine.org
>====================================