SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   MyBB Vendors:   MyBB Group
MyBB domecode() Input Validation Error Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016270
SecurityTracker URL:  http://securitytracker.com/id/1016270
CVE Reference:   CVE-2006-2908   (Links to External Site)
Date:  Jun 12 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.1.2
Description:   A vulnerability was reported in MyBB. A remote user can include and execute arbitrary code on the target system.

The 'inc/functions_post.php' script does not properly validate user-supplied input in the 'username' parameter. A remote user can register an account with a specially crafted username. Then, the remote user can preview a message that contains the string '/slap' to execute arbitrary PHP code on the target system. The PHP code, including operating system commands, will run with the privileges of the target web service.

The vulnerability resides in the domecode() function.

The vendor was notified on June 6, 2006.

Andreas Sandblad of Secunia Research discovered this vulnerability.

Impact:   A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
Solution:   The vendor has issued a fixed version (1.1.3), available at:

http://www.mybboard.com/downloads.php

Vendor URL:  www.mybboard.com/ (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Secunia Research: MyBB "domecode()" PHP Code Execution Vulnerability

======================================================================

                     Secunia Research 12/06/2006

         - MyBB "domecode()" PHP Code Execution Vulnerability -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

======================================================================
1) Affected Software

MyBB 1.1.2

Prior versions may also be affected.

======================================================================
2) Severity

Rating: Highly critical
Impact: System access
Where:  Remote

======================================================================
3) Vendor's Description of Software

MyBB is a powerful, efficient and free forum package developed in PHP 
and MySQL. MyBB has been designed with the end users in mind, you and 
your subscribers. Full control over your discussion system is 
presented right at the tip of your fingers, from multiple styles and 
themes to the ultimate customisation of your forums using the 
template system.

Product link:
http://www.mybboard.com/

======================================================================
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in MyBB, which can be 
exploited by malicious people to compromise a vulnerable system.

Input passed to the username field when registering isn't properly 
sanitised before being used in a "preg_replace" call with the "e" 
modifier in the "domecode()" function in inc/functions_post.php. This 
can be exploited to execute arbitrary PHP code by first registering 
with a specially crafted username and then previewing a post 
containing the "/slap" string.

The vulnerability has been confirmed in version 1.1.2. Prior versions 
may also be affected.

======================================================================
5) Solution

Update to version 1.1.3.
http://www.mybboard.com/downloads.php

======================================================================
6) Time Table

06/06/2006 - Initial vendor notification.
06/06/2006 - Vendor confirms vulnerability.
12/06/2006 - Public disclosure.

======================================================================
7) Credits

Discovered by Andreas Sandblad, Secunia Research.

======================================================================
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned 
CVE-2006-2908 for the vulnerability.

======================================================================
9) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
10) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-40/advisory/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC