Multiple Vulnerabilities in Invision Power Board v1.3.1 Final.

[JvdR]

Description: Multiple Vulnerabilities in Invision Power Board v1.3.1 Final.
Compromise: SQL Injection, Cross site Scripting.
Vulnerable Systems: Invision Power Board v1.3.1 Final.
Details:
An Input Validation Error exists in ssi.php.

$sql_fields is vulnerable to An Input Validation Error.
How to exploit this bug?
http://TARGET/ssi.php?a=out&type=xml&f=0)[SQL-INJECTION]


The second bug is : Multiple Cross site Scripting bugs.
The vulnerable fields of Invision Power Board are
"f","c","username","showtopic","showuser".
How to exploit this bug?
http://TARGET/index.php?act=Reg&CODE...er=0&UserName='><script>alert
(document.cookie)</script>


Solution:
No solution provided.

Greetings,


Jan van de Rijt aka The Warlock.
http://members.home.nl/thewarlock/

[JvdR]

Dear Mike,

The CSS vulnerabilities are based on previous versions of IPB,
the vendor did not feel to fix them with update 1.3 > 1.3.1 final.
see http://securityfocus.com/bid/9768

Multiple SQL Injection Vulnerabilities were already found in IPB,
http://securityfocus.com/bid/7290
http://securityfocus.com/bid/9232

The problem that the vendor did fix was a vulnerability in the calendar.
http://securityfocus.com/bid/9353

In history IPB was more than once vulnerable to SQL injections of the
same type, so there is no reason to provide them with old information.

An other reason is that those kinds of vulns. are common, old news....
a query in google results in 100.000 full instructions to exploit them,
for ISP's it's quite easy to block these requests and minimize the risks.


> Mike Healan wrote:
> Where is the vendor response to this? From what I can see at their
> support site, they've never heard of these two problems.
>
> Let me guess, you never bothered to contact them and instead elected to
> publicize full instructions to exploit software in use at over 100,000
> web sites?

BR,
Jan van de Rijt.
--->
http://members.home.nl/thewarlock

[Mike Healan]

Where is the vendor response to this? From what I can see at their
support site, they've never heard of these two problems.

Let me guess, you never bothered to contact them and instead elected to
publicize full instructions to exploit software in use at over 100,000
web sites?

JvdR wrote:

> Description: Multiple Vulnerabilities in Invision Power Board v1.3.1 Final.
> Compromise: SQL Injection, Cross site Scripting.
> Vulnerable Systems: Invision Power Board v1.3.1 Final.
> Details:
> An Input Validation Error exists in ssi.php.
>
> $sql_fields is vulnerable to An Input Validation Error.
> How to exploit this bug?
> http://TARGET/ssi.php?a=out&type=xml&f=0)[SQL-INJECTION]
>
>
> The second bug is : Multiple Cross site Scripting bugs.
> The vulnerable fields of Invision Power Board are
> "f","c","username","showtopic","showuser".
> How to exploit this bug?
> http://TARGET/index.php?act=Reg&CODE...er=0&UserName='><script>alert
> (document.cookie)</script>
>
>
> Solution:
> No solution provided.
>
> Greetings,
>
>
> Jan van de Rijt aka The Warlock.
> http://members.home.nl/thewarlock/
>
>
>
>
>

--

Regards,

Mike Healan
Editor
www.spywareinfo.com

[Hillel Himovich]

In-Reply-To: <000d01c44d68$51a14ec0$05a0968c@p42800mhz>

>Compromise: SQL Injection, Cross site Scripting.
>Vulnerable Systems: Invision Power Board v1.3.1 Final.
>Details:
>An Input Validation Error exists in ssi.php.
>
>$sql_fields is vulnerable to An Input Validation Error.
>How to exploit this bug?
>http://TARGET/ssi.php?a=out&type=xml&f=0)[SQL-INJECTION]

I guss, you are reffering this line in the SQL Statment...
WHERE t.forum_id IN ($sql_fields)
I downloaded IPB 1.3.1 F and digiid for a fwe seconds, if you look a bit up in the code u'll see:

$f = intval($f);
if ( $f )
{
$forums[] = $f;
}
............
............
$sql_fields = implode( ",", $forums );

intval, means that u can't enter string in the f field...