SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   DeluxeBB Vendors:   deluxebb.com
DeluxeBB Input Validation Flaw Lets Remote Users Inject SQL Commands and Include File Bug Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016309
SecurityTracker URL:  http://securitytracker.com/id/1016309
CVE Reference:   CVE-2006-2914, CVE-2006-2915   (Links to External Site)
Date:  Jun 15 2006
Impact:   Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): 1.06; possibly other versions
Description:   A vulnerability was reported in DeluxeBB. A remote user can include and execute arbitrary code on the target system. A remote user can inject SQL commands.

The software does not properly validate user-supplied input in the 'templatefolder' parameter. If 'register_globals' is enabled, a remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location or from a file on the target system. The PHP code, including operating system commands, will run with the privileges of the target web service.

Some demonstration exploit URLs are provided:

http://[target]/templates/deluxe/postreply.php?templatefolder=[file]
http://[target]/templates/deluxe/posting.php?templatefolder=[file]
http://[target]/templates/deluxe/pm/newpm.php?templatefolder=[file]
http://[target]/templates/default/postreply.php?templatefolder=[file]
http://[target]/templates/default/posting.php?templatefolder=[file]
http://[target]/templates/default/pm/newpm.php?templatefolder=[file]

The software does not properly validate user-supplied input in the 'hideemail', 'languagex', 'xthetimeoffset, and 'xthetimeformat' parameters when an account is registered. If 'magic_quotes_gpc' is disabled, a remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.

The vendor was notified on May 26, 2006.

Andreas Sandblad of Secunia Research discovered this vulnerability.

Impact:   A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.

A remote user can execute SQL commands on the underlying database.

Solution:   No solution was available at the time of this entry.
Vendor URL:  www.deluxebb.com/ (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Secunia Research: DeluxeBB SQL Injection and File Inclusion

======================================================================

                     Secunia Research 14/06/2006

    - DeluxeBB SQL Injection and File Inclusion Vulnerabilities -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerabilities.......................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9

======================================================================
1) Affected Software

DeluxeBB 1.06

Other versions may also be affected.

Product link:
http://www.deluxebb.com/

======================================================================
2) Severity

Rating: Highly critical
Impact: System access, manipulation of data
Where:  From remote

======================================================================
3) Description of Vulnerabilities

Secunia Research has discovered some vulnerabilities in DeluxeBB, 
which can be exploited by malicious people to conduct SQL injection 
attacks and compromise a vulnerable system.

1) Input passed to the "templatefolder" parameter in various scripts 
isn't properly verified, before it is used to include files. This can 
be exploited to include arbitrary files from external and local 
resources.

Examples:
http://[host]/templates/deluxe/postreply.php?templatefolder=[file]
http://[host]/templates/deluxe/posting.php?templatefolder=[file]
http://[host]/templates/deluxe/pm/newpm.php?templatefolder=[file]
http://[host]/templates/default/postreply.php?templatefolder=[file]
http://[host]/templates/default/posting.php?templatefolder=[file]
http://[host]/templates/default/pm/newpm.php?templatefolder=[file]

Successful exploitation requires that "register_globals" is enabled.

2) Input passed to the "hideemail", "languagex", "xthetimeoffset", 
and "xthetimeformat" parameters when registering for an account 
isn't properly sanitised before being used in a SQL query. This can 
be exploited to manipulate SQL queries by injecting arbitrary SQL 
code.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

The vulnerabilities have been confirmed in version 1.06. Other 
versions may also be affected.

======================================================================
4) Solution

Edit the source code to ensure that input is properly sanitised and 
verified.

======================================================================
5) Time Table

26/05/2006 - Initial vendor notification.
14/06/2006 - Public disclosure.

======================================================================
6) Credits

Discovered by Andreas Sandblad, Secunia Research.

======================================================================
7) References

The Common Vulnerabilities and Exposures (CVE) project has assigned 
CVE-2006-2914 (file inclusion) and CVE-2006-2915 (SQL injection) 
for the vulnerabilities.

======================================================================
8) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-44/advisory/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC