upb.admin.txt

`  
product: Ultimate PHP Board (UPB)   
version: Public Beta 1.0b !!FIXED   
vendor: http://www.webrc.ca/php/upb.php  
summary: upb allow to any user have access levels 3 (to have admin premissions)  
exploit: yes  
Fix: yes  
Exploited by Hipik__ memmbers of www.hackeri.org Bosnians Security Portal  
email:[email protected]  
__________________  
I have been registred user 'Hipik__' and I have memmbes permissions.   
After that I Log on UPB Forum and I run the following URL:  
http://www.example.com/admin_members.php  
and I can put myself Admin permissions.   
And that is it. I can cange evrythin on page.  
Also if you don't have admin permissions you can go on followinf URL:  
http://www.example.com/admin_config.php   
and you can manipulet UPB forum Title bar Name color or you can go on following URL:  
http://www.example.com/admin_cat.php  
and you can manipulete Forum Category or if you wan delete forums whitout Admin   
permissions go on following URL:  
http://www.example.com/admin_forum.php  
_________________________  
Exploit:  
Register on UPB Forum and Log on then go on one of the following URL:  
http://www.example.com/admin_members.php  
http://www.example.com/admin_config.php   
http://www.example.com/admin_cat.php  
http://www.example.com/admin_forum.php  
_________________________  
Vulnerable code:  
in files admin_members.php, admin_config.php, admin_cat.php, admin_forum.php   
and other admin_ files contains this line code:  
  
if(is_logged_in($user_env, $pass_env, $power_env, $id_env)) {  
  
This line of code don't check does user have Admin premissions. Just check does is he Log on.  
_________________________  
Solution:  
This line of code in files admin_members.php, admin_config.php, admin_cat.php, admin_forum.php   
and other admin_ files:  
  
if(is_logged_in($user_env, $pass_env, $power_env, $id_env)) {  
  
Change with this line of code:  
  
if(is_logged_in($user_env, $pass_env, $power_env, $id_env) && $power_env == 3) {  
  
________________________  
NickName: Hipik__  
E-mail: [email protected]  
URL: http://www.hackeri.org  
IRC Server: irc.dal.net Channel:#hackeri  
The beast Security group in Bosnia  
--------------------------------------------------------------  
Sory for my pour English :(  
`