Warum ist das ein Sicherheitsleck?

[Rainer K.]

Hallo,

ich habe eine Frage zu folgendem Fix, den ich nicht verstehe:

Possible SQL injection vulnerability in 2.0.5
Posted on Fri 20 Jun, 2003 14:33 by stefan
As Announced on www.phpbb.com:


Quote:We've been informed that a possible SQL injection vulnerability has been released to various lists and sites. The issue is unlikely to affect many users given the requirements that surround it.

The problem is easily fixed, open viewtopic.php and before:


Code:if ( isset($HTTP_GET_VARS[POST_TOPIC_URL]) )
{
$topic_id = intval($HTTP_GET_VARS[POST_TOPIC_URL]);
}
else if ( isset($HTTP_GET_VARS['topic']) )
{
$topic_id = intval($HTTP_GET_VARS['topic']);
}


add:


Code:$topic_id = $post_id = false;


Scroll down and find:


Code:$join_sql_table = ( !isset($post_id) ) ? '' : ", " . POSTS_TABLE . " p, " . POSTS_TABLE . " p2 ";
$join_sql = ( !isset($post_id) ) ? "t.topic_id = $topic_id" : "p.post_id = $post_id AND t.topic_id = p.topic_id AND p2.topic_id = p.topic_id AND p2.post_id <= $post_id";
$count_sql = ( !isset($post_id) ) ? '' : ", COUNT(p2.post_id) AS prev_posts";

$order_sql = ( !isset($post_id) ) ? '' : "GROUP BY p.post_id, t.topic_id, t.topic_title, t.topic_status, t.topic_replies, t.topic_time, t.topic_type, t.topic_vote, t.topic_last_post_id, f.forum_name, f.forum_status, f.forum_id, f.auth_view, f.auth_read, f.auth_post, f.auth_reply, f.auth_edit, f.auth_delete, f.auth_sticky, f.auth_announce, f.auth_pollcreate, f.auth_vote, f.auth_attachments ORDER BY p.post_id ASC";


Change that to:


Code:$join_sql_table = ( empty($post_id) ) ? '' : ", " . POSTS_TABLE . " p, " . POSTS_TABLE . " p2 ";
$join_sql = ( empty($post_id) ) ? "t.topic_id = $topic_id" : "p.post_id = $post_id AND t.topic_id = p.topic_id AND p2.topic_id = p.topic_id AND p2.post_id <= $post_id";
$count_sql = ( empty($post_id) ) ? '' : ", COUNT(p2.post_id) AS prev_posts";

$order_sql = ( empty($post_id) ) ? '' : "GROUP BY p.post_id, t.topic_id, t.topic_title, t.topic_status, t.topic_replies, t.topic_time, t.topic_type, t.topic_vote, t.topic_last_post_id, f.forum_name, f.forum_status, f.forum_id, f.auth_view, f.auth_read, f.auth_post, f.auth_reply, f.auth_edit, f.auth_delete, f.auth_sticky, f.auth_announce, f.auth_pollcreate, f.auth_vote, f.auth_attachments ORDER BY p.post_id ASC";


I would like to add that (as now typical ...) we were given practically no time to fix this issue before it appeared on the web.

Die Änderung bewirkt nach meinem Verständnis, gar nix?

intval() wandelt doch den in der URL enthaltenen Variablenwert in einen Integer, also wie will man da eine SQL injection machen?
Um eine fiese SQL Query einzubauen, müßte man aber einen String in $topic_id oder $post_id speichern können, oder?

Grüße, Rainer

[PhilippK]

Das ist dann 'nen Loch, wenn in PHP die globalen Variablen aktiviert sind. Dann kannst du mit ...?topic_id=SomeSQL die Variable topic_id mit beliebigem Code füllen. So zumindest in der Kurzform.

Gruß, Philipp

[Rainer K.]

Ahhh, jetzt kapier ichs. Danke für den Tipp!

Der Knackpunkt liegt in den globalen Variablen von PHP wenn register_globals auf On steht.
Dann wird eine in der URL übergebene Variable z.B. test.php&dings=xxx
$dings mit dem Wert 'xxx' erzeugt.

Aber warum der Fix so kompliziert ist, versteh ich trotzdem nicht. Sollte nicht ein unset($topic_id) vor den if's der Zuweisung reichen?

Grüße, Rainer