Topic: Minor security issue in punbb with SQLite

Minor security issue in punbb with SQLite

Georgi Guninski security advisory #76, 2019

Running punbb-master from h t t p s://github.com/punbb/punbb from Thu 07 Nov 2019 11:23:33 AM UTC

Installing on h t t p://host/forum In install.php set:

database type: SQLite3
database name: database1

Accessing h t t p://host/forum/database1 returns the full raw database, including hashes and email addresses.

If attacker guesses the name "database1" or brute force from common database names, this gives her read access of the raw database.

If you consider this a bug, as workaround set database to something hard to guess.

Other forum software explicitly want the SQLite database to be non-accessible from the web.

https://j.ludost.net/blog/archives/2019 … index.html

ForkBB
I speak only Russian  :P

Re: Minor security issue in punbb with SQLite

Two solutions:

1. Move the database file outside the web directory
    After transferring the file, set the $db_name variable in the config.php file.
    For example there was

$db_name = 'database';

    Moved the file to the directory up, it became

$db_name = '../database';

2. Or block access to the database file using the web server settings

ForkBB
I speak only Russian  :P

Re: Minor security issue in punbb with SQLite

+ Hide name of db for SQLite(3) in errors
https://github.com/MioVisman/punbb/comm … fafb816a8c

ForkBB
I speak only Russian  :P

Re: Minor security issue in punbb with SQLite

@Visman, ты лучший! Меньше чем за месяц залатал весь движок для php 7.4 https://punbb.info/extensions/pan_smiles/pack/PunBB_INFO_ICQ/thumbsup.gif