[VulnDiscuss] Re: phpBB password disclosure by sql injection

> There is sql injection vuln in phpBB. The variable "topic_id" is passed
> directly from GET to sql query in /viewtopic.php. It can be used 
> to get md5 passwords for users. I am attaching details and proof of
> concept code.  I've only tested this on mysql 4 and pgsql at my home
> machines so I might have missed something...

I am running phpBB 2.0.4 and MySQL 3.23.x  I don't run into this
problem.  The intval() function is used to pull the integer value from
the querystring and this is assigned to $topic_id.  I don't see anywhere
that it is used directly from the querystring.

Here are the four times that $topic_id is assigned in my version of
view_topic.php


$ grep '$topic_id = ' viewtopic.php

        $topic_id = intval($HTTP_GET_VARS[POST_TOPIC_URL]);
        $topic_id = intval($HTTP_GET_VARS['topic']);
        $topic_id = intval($row['topic_id']);
        $topic_id = intval($forum_topic_data['topic_id']);


Dan Daggett