MyBB domecode() Input Validation Error Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016270
|
|
SecurityTracker URL: http://securitytracker.com/id?1016270
|
|
CVE Reference: CVE-2006-2908
(Links to External Site)
|
Date: Jun 12 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Secunia Research
|
Version(s): 1.1.2
|
Description: A vulnerability was reported in MyBB. A remote user can include and execute arbitrary code on the target system.
The 'inc/functions_post.php' script does not properly validate user-supplied input in the 'username' parameter. A remote user can
register an account with a specially crafted username. Then, the remote user can preview a message that contains the string '/slap'
to execute arbitrary PHP code on the target system. The PHP code, including operating system commands, will run with the privileges
of the target web service.
The vulnerability resides in the domecode() function.
The vendor was notified on June 6, 2006.
Andreas
Sandblad of Secunia Research discovered this vulnerability.
|
Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution: The vendor has issued a fixed version (1.1.3), available at:
http://www.mybboard.com/downloads.php
|
Vendor URL: www.mybboard.com/ (Links to External Site)
|
Cause: Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Secunia Research <vuln-remove@secunia.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 12 Jun 2006 17:20:38 +0200
From: Secunia Research <vuln-remove@secunia.com>
Subject: Secunia Research: MyBB "domecode()" PHP Code Execution Vulnerability
|
======================================================================
Secunia Research 12/06/2006
- MyBB "domecode()" PHP Code Execution Vulnerability -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10
======================================================================
1) Affected Software
MyBB 1.1.2
Prior versions may also be affected.
======================================================================
2) Severity
Rating: Highly critical
Impact: System access
Where: Remote
======================================================================
3) Vendor's Description of Software
MyBB is a powerful, efficient and free forum package developed in PHP
and MySQL. MyBB has been designed with the end users in mind, you and
your subscribers. Full control over your discussion system is
presented right at the tip of your fingers, from multiple styles and
themes to the ultimate customisation of your forums using the
template system.
Product link:
http://www.mybboard.com/
======================================================================
4) Description of Vulnerability
Secunia Research has discovered a vulnerability in MyBB, which can be
exploited by malicious people to compromise a vulnerable system.
Input passed to the username field when registering isn't properly
sanitised before being used in a "preg_replace" call with the "e"
modifier in the "domecode()" function in inc/functions_post.php. This
can be exploited to execute arbitrary PHP code by first registering
with a specially crafted username and then previewing a post
containing the "/slap" string.
The vulnerability has been confirmed in version 1.1.2. Prior versions
may also be affected.
======================================================================
5) Solution
Update to version 1.1.3.
http://www.mybboard.com/downloads.php
======================================================================
6) Time Table
06/06/2006 - Initial vendor notification.
06/06/2006 - Vendor confirms vulnerability.
12/06/2006 - Public disclosure.
======================================================================
7) Credits
Discovered by Andreas Sandblad, Secunia Research.
======================================================================
8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2006-2908 for the vulnerability.
======================================================================
9) About Secunia
Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:
http://secunia.com/
Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/secunia_security_advisories/
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-40/advisory/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
|
|
