COMMAND

	Instaboard SQL injection

SYSTEMS AFFECTED

	NetPleasure's Instaboard 1.3

PROBLEM

	Jim    Dew    [jdew(at)cleannorth.org]    reported    sql     injections
	vulnerabilities:
	
	
	http://server/instaboard/index.cfm?frmid=1%20AND%20u.userid%20IN%20(select%20userid%20from%20users)
	http://server/instaboard/index.cfm?frmid=1&tpcid=1%20SQL
	http://server/instaboard/index.cfm?frmid=1%20SQL&tpcid=1
	http://server/instaboard/index.cfm?pr=replymsg&frmid=1&tpcid=1%20SQL&msgid=11
	http://server/instaboard/index.cfm?pr=replymsg&frmid=1&tpcid=1&msgid=11%20SQL
	http://server/instaboard/index.cfm?catid=1%20SQL
	

SOLUTION

	If you have the licensed version of the product, protect  the  numerical
	values within the CFQUERY tags:
	
	for example:
	
	In queries/oraclen/qry_GetOriginalMessage.cfm
	
	    change
	
	
	  WHERE m.tpcid = #tpcid#
	  AND m.userid = u.userid
	  AND m.msgid = #msgid#
	
	
	to
	
	
	  WHERE m.tpcid = #VAL(tpcid)#
	  AND m.userid = u.userid
	  AND m.msgid = #VAL(msgid)#