Exploit-DB #5826
Description: Simple Machines Forum (SMF) 1.1.4 - SQL Injection
Type: webapps
Platform: php
Date: 2008-06-15
Author: The:Paradox

Exploit:
#!/usr/bin/python
"""
#=================================================================================================#
#                     ____            __________         __             ____  __                  #
#                    /_   | ____     |__\_____  \  _____/  |_          /_   |/  |_                #
#                     |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\               #
#                     |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |                 #
#                     |___|___|  /\__|  /______  /\___  >__|            |___||__|                 #
#                              \/\______|      \/     \/                                          #
#=================================================================================================#
#                                     This was a priv8 Exploit                                    #
#=================================================================================================#
#  	           		    Simple Machines Forum <= 1.1.4                                #
#    		                      Sql Injection Vulnerability    			          #
#                                    Priviledge Escalation Exploit              		  #
#====================================#===========#====================================#===========#
# Server Configuration Requirements  #           # Some Information                   #           #
#====================================#		 #====================================#           #
#                                                #                                                #
# register_globals = 1                           #  Vendor:   www.simplemachines.org              #
#                                                #  Author:   The:Paradox                         #
#================================================#  Severity: N/A		                  #
# 						 #						  #
# You may find exploits updates and more 	 #						  #
# explanations on =>				 #  Proud To Be Italian.                          #
# 	    	http://paradox.altervista.org 	 #  	                 			  #
#                                                #                                                #
#====================================#===========#================================================#
# Board Description		     #								  #
#====================================#								  #
#												  #
# Simple Machines Forum - SMF in short - is a free, professional grade software package that 	  #
# allows you to set up your own online community within minutes.				  #
# Its powerful custom made template engine puts you in full control of the lay-out of your	  #
# message board and with our unique SSI - or Server Side Includes - function you can let your     #
# forum and your website interact with each other.						  #
# SMF is written in the popular language PHP and uses a MySQL database. It is designed to provide #
# you with all the features you need from a bulletin board while having an absolute minimal	  #
# impact on the resources of the server. 							  #
# SMF is the next generation of forum software - and best of all it is and will always 		  #
# remain completely free! 									  #
#												  #
#====================================#============================================================#
# Proof Of Concept / Bug Explanation #                                                            #
#====================================#                                                            #
# This is a quite old exploit and it is inapplicable on 1.1.5 version and on last 2.0 pre-release #
# (that's why I decided to public it). First, let's have a little poc.				  #
#=================================================================================================#

[Load.php]

148.	if (isset($db_character_set) && preg_match('~^\w+$~', $db_character_set) === 1)
149.		db_query("
150.			SET NAMES $db_character_set", __FILE__, __LINE__);


#=================================================================================================#
# In Load.php if $db_character_set is set Smf will execute a Set Names Sql Query.      		  #
# Directly from dev.mysql.com let's see what it means.						  #
#												  #
# "SET NAMES indicates what character set the client will use to send SQL statements to the       #
# the server. Thus, SET NAMES 'cp1251' tells the server future incoming messages from this client #
# are in character set cp1251."									  #
#												  #
# Ok, now let's see what $db_character_set is.							  #
# $db_character_set is a "Settings.php variable" written only if a "Non-Default tick"	          #
# is checked during the installation process.							  #
# The real vulnerability is when the "Non-Default tick" is left unchecked, Smf doesn't write      #
# it in "Settings.php" and no value is assigned to it: it's possible to set it 			  #
# via register_globals.										  #
# 												  #
# Now the cool poc section =D 									  #
# Surely you saw that preg_match avoids any injection of non-alphanumerical chars in the query    #
# at line 150 in Load.php 	  								  #
# So, how is possible to take advantage of that?						  #
# To understand this vulnerability you have to comprehend some character set presents multibyte	  #
# characters and they may obiate addslashes() function.		  	  			  #
# Addslashes simply adds a backslash (0x5c) before single quote ('), double quote ("), 		  #
# backslash (\) and NUL (the NULL byte), without checking if the added blackslash creates 	  #
# another char.											  #
# No, i'm not going mad :P Here is an example:							  #
#												  #
# 	   				    Bytes in Input 					  #
#	      				        0xa327						  #
#												  #
#      				       Addslashes(Bytes in Input)				  #
#    	     				       0xa35c27