CVE-2011-4066
Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 17992
Publication date : 2011-10-16 22h00 +00:00
Author : flyh4t
EDB Verified : No
# Exploit Title: Gnuboard <= 4.33.02 PATH_INFO SQL INJECTION Vulnerability
# Google Dork: inurl:gnuboard4/bbs/board.php
# Date: 2011-2-14
# Author: flyh4t
# Software Link: http://sir.co.kr/main/gnuboard4/
# Version: Gnuboard <= 4.33.02
# Tested on: linux+apache
# CVE : CVE-2011-4066
Gnuboard <= 4.33.02 PATH_INFO SQL INJECTION Vulnerability
---------------------------------
Bug found By Flyh4t & alpha.liu
mail:
flyh4t phpsec@hotmail.com
alpha alpha@patching.net
Site:bbs.wolvez.org
---------------------------------
SIR GNUBoard(http://sir.co.kr) is a widely used bulletin board system of Korea.
It is freely available for all platforms that supports PHP and MySQL.
But we find a SQL INJECTION affects SIR GNUBoard version 4.33.02
The codes can be download here
http://sir.co.kr/main/gnuboard4/
Here is the Vulnerability code in /bbs/tb.php
-----------------------vul code-------------------
//bbs/tb.php
$arr = explode("/", $_SERVER[PATH_INFO]);
//$_SERVER[PATH_INFO] is not affected by the magic_quotes_gpc set of php
//we can inject arbitrary sql code include single quotes through $_SERVER[PATH_INFO]
$bo_table = $arr[1];
$wr_id = $arr[2];
$to_token = $arr[3];
//we can pass arbitrary sql code to $bo_table
$write_table = $g4[write_prefix] . $bo_table;
// $write_table can be injected through $bo_table
$sql = " select wr_id, ca_name, wr_email from $write_table where wr_id = '$wr_id' ";
//here $write_table lead to sql injection,and no need of single quotes
$wr = sql_fetch($sql, FALSE);
if (!$wr[wr_id] || !($_POST[title] && $_POST[excerpt] && $_POST[url] && $_POST[blog_name]))
{
$tmp_dir = str_replace("/tb.php", "", $_SERVER[SCRIPT_NAME]);
header("location:$tmp_dir/board.php?bo_table=$bo_table&wr_id=$wr_id");
exit;
}
-----------------------vul code end-------------------
-----------------------poc------------------------
bbs/tb.php/[sql]/[sql]
--------------------------------------------------
Products Mentioned
Configuraton 0
Sir>>Gnuboard >> Version To (including) 4.33.02
- Sir>>Gnuboard >> Version - (Open CPE detail)
- Sir>>Gnuboard >> Version 3.40 (Open CPE detail)
- Sir>>Gnuboard >> Version 4.31.3 (Open CPE detail)
- Sir>>Gnuboard >> Version 4.31.4 (Open CPE detail)
- Sir>>Gnuboard >> Version 4.33.2 (Open CPE detail)
Sir>>Gnuboard >> Version 3.30
Sir>>Gnuboard >> Version 3.31
Sir>>Gnuboard >> Version 3.32
Sir>>Gnuboard >> Version 3.33
Sir>>Gnuboard >> Version 3.34
Sir>>Gnuboard >> Version 3.35
Sir>>Gnuboard >> Version 3.36
Sir>>Gnuboard >> Version 3.37
Sir>>Gnuboard >> Version 3.38
Sir>>Gnuboard >> Version 3.39
Sir>>Gnuboard >> Version 3.40
- Sir>>Gnuboard >> Version 3.40 (Open CPE detail)
Sir>>Gnuboard >> Version 4.31.03
