[UNIX] New YabbSE Remote Code Execution Vulnerability Found (News.php)

• Previous message: support@securiteam.com: "[UNIX] Multiple Vulnerabilities in Old Releases of MIT Kerberos"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: support@securiteam.com
To: list@securiteam.com
Date: 29 Jan 2003 16:16:44 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

Beyond Security would like to welcome Tiscali World Online
to our service provider team.
For more info on their service offering IP-Secure,
please visit http://www.worldonline.co.za/services/work_ip.asp
- - - - - - - - -

  New YabbSE Remote Code Execution Vulnerability Found (News.php)
------------------------------------------------------------------------

SUMMARY

YabbSE contains a file called News.php that is found in the root
directory. For some unknown reason the vendor did not place this file
inside /Sources even though this file is only intended to be used as an
include. An attacker can combine his own server with the victim in such
way that it would allow him/her to include remote arbitrary code on the
victim's server and run it with web server permissions.

DETAILS

Vulnerable systems:
 * Yabb SE version 1.5.1 and prior

The attack works as follows:
********
.
$dbcon = mysql_connect($db_server,$db_user,$db_passwd);
mysql_select_db ($db_name);
.
********

First, we can see News.php is trying to connect to the SQL database. We
can see that the variables above that contain the database information are
not defined and may be changed by the attacker. If the attacker installs
YabbSE on his/her server and allows a remote SQL connection, then News.php
will think the database has been loaded successfully and run the following
lines:

********
.
if ($template == null)
include("news_template.php");
else
{
if ($ext == null)
include($template.".php");
else
include($template.".".$ext);
}
.
********

Since template is never defined before, the attacker may inject into
$template his/her own remote file. News.php will include the attacker's
code, run it on the server, and give the attacker the ability to execute
arbitrary code on the server with web server permissions.

Solution:
Please check the vendor's website for new patches. As a temporary solution
rename News.php to News.inc and wait for vendor's reply.

ADDITIONAL INFORMATION

The information has been provided by <mailto:mindwarper@hush.com>
mindwarper.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Next message: support@securiteam.com: "[UNIX] Multiple Cross-Site Scripting Vulnerabilities in Nuked-Klan"
• Previous message: support@securiteam.com: "[UNIX] Multiple Vulnerabilities in Old Releases of MIT Kerberos"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]