477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
73 lines
2.6 KiB
Text
Executable file
73 lines
2.6 KiB
Text
Executable file
##########################################################
|
|
# GulfTech Security Research September 20, 2008
|
|
##########################################################
|
|
# Vendor : Electron Inc.
|
|
# URL : http://www.anelectron.com/
|
|
# Version : AEF Forum <= 1.0.6
|
|
# Risk : Remote Code Execution
|
|
##########################################################
|
|
|
|
|
|
|
|
Description:
|
|
Advanced Electron Forum also known as AEF Forum is a full featured
|
|
online forum system written in php that allows webmasters and site
|
|
owners to host their own discussion forums within their website.
|
|
The Advanced Electron Forum software comes bundled with the popular
|
|
MKPortal package, but is also available as a free stand alone forum.
|
|
Unfortunately there are multiple remote code execution issues within
|
|
AEF that allow for an attacker to execute arbitrary php code with
|
|
privileges of the affected webserver. This is due to the improper
|
|
handling of evaluated bbcode within AEF Forum. Users should upgrade
|
|
their forums as soon as possible.
|
|
|
|
|
|
|
|
Remote Code Execution:
|
|
There is a serious security issue within AEF Forums that allows for
|
|
forum users to easily execute arbitrary php code on the affected
|
|
webserver. This issue is due to AEF Forums sending wildcard matches
|
|
to the replacement parameter of preg_replace function, within double
|
|
quotes, while the eval switch is present. Below is one of the many
|
|
examples of the security issues within the bbcode handling of AEF.
|
|
|
|
//Email Links
|
|
if($globals['bbc_email']){
|
|
|
|
$text = preg_replace(
|
|
array("/\[email=(.*?)\](.*?)\[\/email\]/ies",
|
|
"/\[email\](.*?)\[\/email\]/ies"),
|
|
array('check_email("$1", "$2")',
|
|
'check_email("$1", "$1")'), $text);
|
|
|
|
}
|
|
|
|
As we can see from the above code, a wildcard match is used to gather
|
|
the matches sent to replacement parameter for evaluation. This is bad
|
|
because an attacker can use complex variable syntax within an [email]
|
|
tag (other tags are also vulnerable) and have it executed as php code.
|
|
|
|
[email]{${phpinfo()}}[/email]
|
|
|
|
If the above bb code was posted to a vulnerable AEF Forum then the php
|
|
within the tags would be executed. In this case the php code is simply
|
|
a phpinfo() call, but of course, other attacks are possible.
|
|
|
|
|
|
|
|
Solution:
|
|
Thanks to Jim Haslip for his help with communicating this issue to
|
|
developers. Users should upgrade as soon as possible.
|
|
|
|
|
|
|
|
Credits:
|
|
James Bercegay of the GulfTech Security Research Team
|
|
|
|
|
|
|
|
Related Info:
|
|
The original advisory can be found at the following location
|
|
http://www.gulftech.org/?node=research&article_id=00131-09202008
|
|
|
|
# milw0rm.com [2008-09-20]
|