SQL-injections in Invision Power Board v2.0.1

[CENSORED]

************************************************** ******
SQL-injections in Invision Power Board v2.0.1
************************************************** ******
--------------------------
Program: IPB 2.0.1
Homepage: http://www.invisionboard.com
Vulnerable Versions: IPB 2.0.1
Has found: CENSORED
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~
Vulnerability has been found in forum Invision Power Board v2.0.1
At citing messages.
Here an example:
http://127.0.0.1/forum/index.php? act=PostCODE=02f=4t=2qpid=2
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~

If in the end of parameter to put ' the forum swears on
Syntactic mistake:

mySQL query error: select p. *, t.forum_id FROM ibf_posts p
LEFT JOIN ibf_topics t ON (t.tid=p.topic_id) WHERE pid IN ()
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~

SQL an injection
Example:
http://127.0.0.1/forum/index.php? act=PostCODE=02f=4t=3qpid = ' [SQL]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~

I tested vulnerability for versions 2.0.1
Other versions as can be mentioned.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~

As have been found vulnerability of other character, but about them
I shall not inform yet
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~
On any questions address:

CENSORED [SVT]-Search Vulnerabilities Team
www.security-tmp.net.ru

************************************************** *******

[Steven M. Christey]

This issue appears to be a rediscovery of a Bugtraq post by Alexander
Anisimov on November 18, 2004:

[MaxPatrol] SQL-injection in Invision Power Board 2.x
http://www.securityfocus.com/archive/1/381503

1) Both inject the SQL into the "qpid" parameter

2) Both deal with the "post" action ("act=Post") in index.php

3) The vendor fixed the issue as identified in the following forum
post:

http://forums.invisionpower.com/inde...owtopic=154916


- Steve