DeluxeBB Input Validation Flaw Lets Remote Users Inject SQL Commands and Include File Bug Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016309
|
|
SecurityTracker URL: http://securitytracker.com/id?1016309
|
|
CVE Reference: CVE-2006-2914
, CVE-2006-2915
(Links to External Site)
|
Date: Jun 15 2006
|
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Advisory: Secunia Research
|
Version(s): 1.06; possibly other versions
|
Description: A vulnerability was reported in DeluxeBB. A remote user can include and execute arbitrary code on the target system. A remote user can inject SQL commands.
The software does not properly validate user-supplied input in the 'templatefolder' parameter. If 'register_globals' is enabled,
a remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote
location or from a file on the target system. The PHP code, including operating system commands, will run with the privileges of
the target web service.
Some demonstration exploit URLs are provided:
http://[target]/templates/deluxe/postreply.php?templatefolder=[file]
http://[target]/template
s/deluxe/posting.php?templatefolder=[file]
http://[target]/templates/deluxe/pm/newpm.php?templatefolder=[file]
http://[target]/templates/default/postreply.php?templatef
older=[file]
http://[target]/templates/default/posting.php?templatefolder=[file]
http://[target]/templates/default/pm/newpm.php?templatefolder=[file]
The
software does not properly validate user-supplied input in the 'hideemail', 'languagex', 'xthetimeoffset, and 'xthetimeformat' parameters
when an account is registered. If 'magic_quotes_gpc' is disabled, a remote user can supply a specially crafted parameter value
to execute SQL commands on the underlying database.
The vendor was notified on May 26, 2006.
Andreas Sandblad of Secunia Research
discovered this vulnerability.
|
Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
A remote user can execute SQL commands on the underlying database.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.deluxebb.com/ (Links to External Site)
|
Cause: Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Secunia Research <vuln-remove@secunia.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 14 Jun 2006 14:17:09 +0200
From: Secunia Research <vuln-remove@secunia.com>
Subject: Secunia Research: DeluxeBB SQL Injection and File Inclusion
|
======================================================================
Secunia Research 14/06/2006
- DeluxeBB SQL Injection and File Inclusion Vulnerabilities -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Description of Vulnerabilities.......................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9
======================================================================
1) Affected Software
DeluxeBB 1.06
Other versions may also be affected.
Product link:
http://www.deluxebb.com/
======================================================================
2) Severity
Rating: Highly critical
Impact: System access, manipulation of data
Where: From remote
======================================================================
3) Description of Vulnerabilities
Secunia Research has discovered some vulnerabilities in DeluxeBB,
which can be exploited by malicious people to conduct SQL injection
attacks and compromise a vulnerable system.
1) Input passed to the "templatefolder" parameter in various scripts
isn't properly verified, before it is used to include files. This can
be exploited to include arbitrary files from external and local
resources.
Examples:
http://[host]/templates/deluxe/postreply.php?templatefolder=[file]
http://[host]/templates/deluxe/posting.php?templatefolder=[file]
http://[host]/templates/deluxe/pm/newpm.php?templatefolder=[file]
http://[host]/templates/default/postreply.php?templatefolder=[file]
http://[host]/templates/default/posting.php?templatefolder=[file]
http://[host]/templates/default/pm/newpm.php?templatefolder=[file]
Successful exploitation requires that "register_globals" is enabled.
2) Input passed to the "hideemail", "languagex", "xthetimeoffset",
and "xthetimeformat" parameters when registering for an account
isn't properly sanitised before being used in a SQL query. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL
code.
Successful exploitation requires that "magic_quotes_gpc" is disabled.
The vulnerabilities have been confirmed in version 1.06. Other
versions may also be affected.
======================================================================
4) Solution
Edit the source code to ensure that input is properly sanitised and
verified.
======================================================================
5) Time Table
26/05/2006 - Initial vendor notification.
14/06/2006 - Public disclosure.
======================================================================
6) Credits
Discovered by Andreas Sandblad, Secunia Research.
======================================================================
7) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2006-2914 (file inclusion) and CVE-2006-2915 (SQL injection)
for the vulnerabilities.
======================================================================
8) About Secunia
Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:
http://secunia.com/
Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/secunia_security_advisories/
======================================================================
9) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-44/advisory/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
|
|
