SQL injection bug in phpBB 2.08

Hangin' Around Joined: Mar 22, 2004 Posts: 49

ffs, another one ! I reckon the phpBB codeing group should employ chatserv and Raven to look over their code and improve *before* they ever release it.

Any idea's guys on how to fix it ?

Only registered users can see links on this board! Get registered or login!

That link is the direct link to the exploit.

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

You know, this is pathetic. I'm sorry to be so harsh, but it is. Actually they should pass their code by the guy who wrote the exploit Evil or Very Mad

Posted: Fri Mar 26, 2004 2:11 pm

Here is the problem code of privmsg.php

EDIT: I'll just remove the code here that I entered, in case it confuses things Smile

Posted: Fri Mar 26, 2004 2:14 pm

I've read the exploit and ultimately it's still the UNION exploit, if I read it correctly. The code isn't quoted properly.

Posted: Fri Mar 26, 2004 2:39 pm

The hack alert script and similar protection lines block this attack, i assume one is to remove the . in $pm_sql_user .= " but i'll wait for phpBB group's reaction.

sigh

New Member Joined: May 29, 2003 Posts: 16

I have tried this on my site...

Raven's Hack Alert stopped it and sent me an email.
Protector Stopped it and recorded it.
Admin Secure sent me an email and stopped it.

Good deal..

Tank863

New Member Joined: Oct 23, 2003 Posts: 24

See this http://www.nettwerked.co.uk/code/privmsg-sqlinj.patch

Posted: Fri Mar 26, 2004 11:58 pm

This I do not understand, privmsg.php comes as it says the patch Rolling Eyes

Posted: Sun Mar 28, 2004 8:43 pm

chatserv wrote:

The hack alert script and similar protection lines block this attack, i assume one is to remove the . in $pm_sql_user .= " but i'll wait for phpBB group's reaction.

sigh

Correct, check http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=185180

Remove the . .

Posted: Sun Mar 28, 2004 11:43 pm

The current zip and the PHP-Nuke Patched version have it already removed, i took it off the day i posted that comment and since nothing seemed to break i went ahead and edited the file.