SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   YaBB SE Vendors:   YaBBSE.org
YaBB SE 'Admin.php' Discloses Installation Path to Remote Users
SecurityTracker Alert ID:  1011166
SecurityTracker URL:  http://securitytracker.com/id/1011166
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 6 2004
Impact:   Disclosure of system information
Exploit Included:  Yes  
Version(s): 1.5.1
Description:   A vulnerability was reported in YaBB SE. A remote user can determine the installation path.

y3dips reported that a remote user can directly access 'sources/Admin.php' to cause the to cause the system to display an error message that indicates the installation path.

A demonstration exploit URL is provided:

http://[target]/yabbse/Sources/Admin.php

The original advisory is available at:

http://echo.or.id/adv/adv05-y3dips-2004.txt

Impact:   A remote user can determine the installation path.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.yabbse.org/ (Links to External Site)
Cause:   Access control error, Exception handling error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  FUll Path Disclosure in YABBSE




ECHO_ADV_05$2004

---------------------------------------------------------------------------
                  FUll Path Disclosure in YABBSE
---------------------------------------------------------------------------

Author: y3dips
Date: August, 25th 2004
Location: Indonesia, Jakarta
Web: http://echo.or.id/adv/adv05-y3dips-2004.txt

---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

YaBB SE: Yet another Bulletin Board Splinter Edition inspired by Zef Hemel
Software Version: YaBB SE 1.5.1  The YaBB SE Development Team

web : http://www.yabbse.org/

---------------------------------------------------------------------------

Vulnerabilities:
~~~~~~~~~~~~~~~~

Full path disclosure:

Script in Sources/Admin.php files are not protected against direct access

A remote user can access the file to cause the system to display an error 
message that indicates the installation path. The resulting error message 
will disclose potentially sensitive installation path information to the 
remote attacker.

POC :

http://localhost/yabbse/Sources/Admin.php

Fatal error: Call to undefined function:
is_admin() in /var/www/html/yabbse/Sources/Admin.php on line 32



---------------------------------------------------------------------------

The fix:
~~~~~~~~
Vendor not contacted yet
but i ll post it to them later

---------------------------------------------------------------------------
Shoutz:
~~~~~~~

~ m0by, the_day, comex, z3r0byt3, K-159, c-a-s-e, S`to @T echo/staff
~ newbie_hacker@yahoogroups.com , #e-c-h-o & #aikmel @DALNET

---------------------------------------------------------------------------
Contact:
~~~~~~~~

     y3dips || echo|staff || y3dips(at)echo(dot)or(dot)id
     Homepage: http://y3dips.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC