+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Are IP Board forums has Sql Injection Vulnerability? (/showthread.php?tid=5946604)
Are IP Board forums has Sql Injection Vulnerability? - Babayaro - Mar 2, 2019
Not sure title is right but I want to know before trying. Does anyone tried to hack or hacked IP board forum?
RE: Are IP Board forums has Sql Injection Vulnerability? - krlo-s - Mar 3, 2019
I'm interested in this as well. Please let me know if you find a way
RE: Are IP Board forums has Sql Injection Vulnerability? - Dotexe - Mar 3, 2019
Yes, IPB systems are vulnerable if you download them thru invisionvirus and similar websites, thus they are publishing a "fix" plugins in order to avoid those holes. The system itself is stable if you purchase it from original devs, what makes it vuln is the plugins you download
RE: Are IP Board forums has Sql Injection Vulnerability? - Babayaro - Mar 3, 2019
(Mar 3, 2019 05:12 AM)Dotexe҆ Wrote: Yes, IPB systems are vulnerable if you download them thru invisionvirus and similar websites, thus they are publishing a "fix" plugins in order to avoid those holes. The system itself is stable if you purchase it from original devs, what makes it vuln is the plugins you download
Thank you for your answer. As I see there's different types (themes) of IP Board forums. Is it possible to see their versions searching for vulnerabilities or exploits?
RE: Are IP Board forums has Sql Injection Vulnerability? - Dotexe - Mar 3, 2019
(Mar 3, 2019 04:08 PM)Babayaro Wrote: Thank you for your answer. As I see there's different types (themes) of IP Board forums. Is it possible to see their versions searching for vulnerabilities or exploits?
You could search the version for vulnerabilities and if there's any you should see it on their forums. But if you ask if there's a tool that does this instead of you, no.
RE: Are IP Board forums has Sql Injection Vulnerability? - Ramb0x - Mar 4, 2019
Long time i see no exploit for IPB. Maybe you can check for some XSS. Or if the forum have an File upload option you can keylog the admin with new WinRAR exploit.......
RE: Are IP Board forums has Sql Injection Vulnerability? - Babayaro - Mar 4, 2019
(Mar 4, 2019 02:08 AM)spix Wrote: Long time i see no exploit for IPB. Maybe you can check for some XSS. Or if the forum have an File upload option you can keylog the admin with new WinRAR exploit.......
Forum has file upload option, what is this new winrar exploit about?
RE: Are IP Board forums has Sql Injection Vulnerability? - Ramb0x - Mar 4, 2019
https://hackforums.net/showthread.php?tid=5944438
Check here on this link.
RE: Are IP Board forums has Sql Injection Vulnerability? - M L T - Mar 6, 2019
We never found any SQLi, but if you have interaction with a mod or admin and can get them to click a link, then you can hack the forum. Check here: https://www.scribd.com/document/396165483/IPB
RE: Are IP Board forums has Sql Injection Vulnerability? - Babayaro - Mar 10, 2019
(Mar 6, 2019 01:35 AM)M L T Wrote: We never found any SQLi, but if you have interaction with a mod or admin and can get them to click a link, then you can hack the forum. Check here: https://www.scribd.com/document/396165483/IPB
I searched forum and realized it's an old version of IP Board forums it must be version 3.x.x
And there's 2 vulnerabilities for these versions CVE-2012-5692 and CVE-2014-9239
Metasploit includes CVE-2012-5692 but gives 403 during run.