phpBB Auction Module SQL Injection and Path Disclosure Vulnerabilities

FrSIRT Advisory : FrSIRT/ADV-2005-0372
CVE Reference : GENERIC-MAP-NOMATCH
Rated as : Moderate
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-04-20

* Technical Description / Exploit *

Two vulnerabilities were reported in phpBB-Auction, which may be exploited by attackers to execute arbitrary SQL commands or disclose the full web path. The first flaw is due to an SQL injection error in the "auction_rating.php" and "auction_offer.php" scripts when handling specially crafted "u" and "ar" parameters. The second vulnerability is due to an input validation error in the "auction_myauctions.php" script when handling a specially crafted "mode" parameter, which may be exploited to display the installation path.

* Affected Products *

phpBB-Auction Module version 1.2m and prior

* Solution *

The FrSIRT is not aware of any official supplied patch for this issue.

* References *

http://www.frsirt.com/english/advisories/2005/0372
http://www.snkenjoi.com/secadv/secadv9.txt