phpGB: mysql injection bug

[ppp-design <security () ppp-design de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ppp-design found the following mysql-injection-bug in phpGB:


Details
- -------
Product: phpGB
Affected Version: 1.20 and maybe all versions before
Immune Version: 1.40
OS affected: all OS with php
Vendor-URL: http://www.walzl.net
Vendor-Status: informed, new version avaiable
Security-Risk: medium - high
Remote-Exploit: Yes


Introduction
- ------------
phpGB ist a php/mysql based guestbook. Admin can change all settings
within a php interface. Unfourtunately the author relies on php
Magic-Quotes for adding slashes to some user input without mentioning
this anywhere in the docs. Therefore it is possible to use an
sql-injection-attack to log in as admin without having the correct
password, when magic_quotes_gpc is not enabled.


More details
- ------------
If the affected webserver has not enabled php's magic_quotes_gpc in
the php.ini, it is possible to login as administrator without needing
any password. The affected page for the login is /admin/login.php. A
possible blackhat is able to add new admins, delete or edit any
guestbook entries and change any configuration including sql-server
settings.


Proof-of-concept
- ----------------
Use an existend administrator name (default is admin here) and use the
following password:
"' OR 'a'='a"
You will be authenticated if magic_quotes_gpc is not enabled.


Temporary-fix
- -------------
Enable magic_quotes_gpc in php.ini.


Fix
- ---
phpGB 1.30 is not fixing this vulnerability correctly, so use phpGB 1.40.


Security-Risk
- -------------
There are not many servers affected, because Magic-Quotes are enabled
per default when installing php. So we decided to rate the security
risk medium-high.


Vendor status
- -------------
After we have informed the author he needed about 12 hours for a new
version. Unfortunately he made a misstake and so only v1.40 which was
released one week later fixes this vulnerability completely.


- --
ppp-design
http://www.ppp-design.de
Public-Key: http://www.ppp-design.de/pgp/ppp-design.asc
Fingerprint: 5B02 0AD7 A176 3A4F CE22  745D 0D78 7B60 B3B5 451A
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: Weitere Infos: siehe http://www.gnupg.org

iD8DBQE9fEtADXh7YLO1RRoRAqCtAJoD6Fzuizqaf+mIubbbCkdAH09MRgCeInZf
XOvAVxH/n2kQ0JXKBVyzf/c=
=UTBJ
-----END PGP SIGNATURE-----