Document Title:
===============
Simple Machine Forum v1.1.10 - Multiple Web Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=118
Release Date:
=============
2011-07-20
Vulnerability Laboratory ID (VL-ID):
====================================
118
Common Vulnerability Scoring System:
====================================
6.5
Product & Service Introduction:
===============================
Simple Machines Forum — SMF in short — is a free, professional grade software package that allows you to set up
your own online community within minutes. Its powerful custom made template engine puts you in full control of the
lay-out of your message board and with our unique SSI - or Server Side Includes - function you can let your forum
and your website interact with each other.
SMF is written in the popular language PHP and uses a MySQL database. It is designed to provide you with all the
features you need from a bulletin board while having an absolute minimal impact on the resources of the server.
SMF is the next generation of forum software - and best of all it is and will always remain completely free!
(Copy of the Vendor Homepage: www.simplemachines.org)
Abstract Advisory Information:
==============================
Vulnerability-Lab Team discovered multiple web vulnerabilities on SimpleMaschineForum (SMF v1.1.10).
Vulnerability Disclosure Timeline:
==================================
2011-07-21: Public or Non-Public Disclosure
Discovery Status:
=================
Published
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
A Sql-Injection vulnerability is detected in the SimpleMaschineForum (SMF v1.1.10).
The vulnerability allows an attacker (remote) with privileged user account to inject/execute own sql commands on the affected dbms.
The vulnerability is located in the control panel with the bound vulnerable param value.
Vulnerable Module(s):
[+] ?params=x
--- SQL Error Logs ---
error: managemembers.php
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right
syntax to use near ×Mý at line 3 File: /home/cms/public_html/cms/smf/Sources/ManageMembers.php Line: 454
// Calculate the number of results.
if (empty($where) or $where == 1 )
$num_members = $modSettings[ totalMembers ];
else
{
$request = db_query(
SELECT COUNT(*)
FROM {$db_prefix}members
WHERE $where , __FILE__, __LINE__);
list ($num_members) = mysql_fetch_row($request);
Proof of Concept (PoC):
=======================
The Vulnerabilities can be exploited by remote attackers. For demonstration or reproduce ...
Path: /smf/
File: index.php
Parm: ?action=viewmembers;sa=query;params=[SQL]
SMF v1.1.9 => SQL-Injection Exploit