SQL Injection in phpBB's groupcp.php

[Jay Gates <zarath@knightsofchaos.com>]

BugTraq,

I have found an SQL injection vulnerability in phpBB. Hoever, I don't think 
this is going to be be a wide spread problem as it will only work if you are 
the moderator of a group.

How the SQL injection works:

In groupscp, it uses an array set to delete members from certain groups. This 
array set is sent through a quick loop to put all the values into a variable 
seperated by , s and then used in an IN check in the SQL query to delete the 
members that you've selected. 
Code:
$members = ( isset($HTTP_POST_VARS['approve']) || 
isset($HTTP_POST_VARS['deny']) ) ? $HTTP_POST_VARS['pending_members'] : 
$HTTP_POST_VARS['members'];

$sql_in = '';
for($i = 0; $i < count($members); $i++)
{
        $sql_in .= ( ( $sql_in != '' ) ? ', ' : '' ) . $members[$i];
}

After this the $sql_in variable is not checked or changed at all, and this is 
where I found the SQL injection to be possible... There are two places this is 
used, first is through a check on if you're the moderator of a group, if you 
are it will run an if IN check on the array first:

$sql = "SELECT ug.user_id, ug.group_id 
        FROM " . AUTH_ACCESS_TABLE . " aa, " . USER_GROUP_TABLE . " ug 
        WHERE ug.user_id IN  ($sql_in) 
        AND aa.group_id = ug.group_id 
        AND aa.auth_mod = 1 
        GROUP BY ug.user_id, ug.group_id 
        ORDER BY ug.user_id, ug.group_id";

From this, it will pull a list of the users in the group and if they're 
moderators from being in the group... If they are, it will remove their 
securities.

Now the second one becomes more critical, this is after the check on if 
moderator:

$sql = "DELETE FROM " . USER_GROUP_TABLE . " 
        WHERE user_id IN ($sql_in) 
        AND group_id = $group_id";

Since this again uses an IN check on the unchecked $sql_in, you can easily 
replace it with something such as $sql_in = 1) or 1=1/*
That would cause, every person in a group to be automatically deleted from it.

To fix this vulnerability, it's fairly simple. Open your groupcp.php file.
Find
$sql_in .= ( ( $sql_in != '' ) ? ', ' : '' ) . $members[$i];

and replace it with
$sql_in .= ( ( $sql_in != '' ) ? ', ' : '' ) . intval($members[$i]);


I'm providing no proof of concept code because you can easily check if you're 
vulnerable by searching for the first line in your groupcp.php file.

Thanks,
  Zarath