SQL injection on custom page

[stryka]

I have a customized page that uses the VB Backend... just got a ton of errors from an IP that i blocked and realized they were trying to fish for passwords and hash values from my vb_user db... can someone take a look at the query and see what else was done... two queries were repeated 1 after the next

query 1

http://sitename.com/script.php?id=100%27%20and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,vb_user.email,0x27,0x7e) FROM `islandm_vbbackup`.vb_user LIMIT 68,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1';

This returned errror with email address: Duplicate entry '~'emailaddy@email.com'~1' for key 'group_key'

query 2
http://sitename.com/script.php?id=100%27%20andand(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,vb_user.password,0x27,0x7e) FROM `islandm_vbbackup`.vb_user LIMIT 68,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1';

This returned errror with what looks like has value: Duplicate entry ~'d81xxxb29cb129179c0eed59ab6c2'~1' for key 'group_key'

have to get my developer involved.. not sure what to advise him.... any ideas how/where i can shut this activity down?

[kh99]

I don't understand whats going on in those queries, but I guess you have a script that takes an id as a parameter on the url then looks it up in the database. If that's correct, then you probably need make sure the id consists of just digits before using it in a query.

ETA: If you're including some vb code in your script, you might be able to use the "clean_gpc" function to get the parameter (although for TYPE_INT I think it just calls intval() on the value).

[encryption]

I just had a similar thing happen to me yesterday... I'm scared because it appears like the attacker was able to grab all usernames/email addresses/password hashes for my site. I'm in process of locking the custom code down, and I wanted to bounce this off everyone else. What are the impacts of an attacker actually getting the password hash for my users in a vBulletin 4 forum? I know it's not possible to reverse engineer the passwords from the hash, but what are the chances that the attacker can generate a different password (or similar one, maybe based on the top 100 most-commonly-used passwords) that has a matching hash?

I also don't see the attacker pulling each user's salt from my database, but is it really needed if they can generate a different random string of characters that matches a user's hash? Let's assume user x on my forum uses the same username/email/password on ten forums. Without the salt, does this mean that the attacker can only generate a matching hash to login to my site, but not any other forum? Or would the attacker be able to generate the hash for all forums? I'm trying to figure out the real impact of what they got..

--------------- Added [DATE]1294709907[/DATE] at [TIME]1294709907[/TIME] ---------------

Here's my take at it... what's everyone's thoughts on this?

Best case, they didn't grab all the info they needed (the salt) and they give up.

Realistic case, they run something to generate a matching hash for each user, and they now have a second password that works for each account along with the actual password.

Worst case, they somehow pulled the salt, even though I see no proof of it, and are able to either match all of our accounts to a top 1000 password list. They know a list of usernames/email addreses that are using a common password and can start to target other sites with the same userid/email address.

Unlikely case, they somehow pulled the salt, even though I see no proof of it, ran a random password generator against each one until they discovered the password for every username/email/password, and will target other sites.