[UNIX] New YabbSE Remote Code Execution Vulnerability Found (News.php)

From: support@securiteam.com
Date: 01/29/03

  • Next message: support@securiteam.com: "[UNIX] Multiple Cross-Site Scripting Vulnerabilities in Nuked-Klan" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 29 Jan 2003 16:16:44 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      New YabbSE Remote Code Execution Vulnerability Found (News.php)
    ------------------------------------------------------------------------

    SUMMARY

    YabbSE contains a file called News.php that is found in the root
    directory. For some unknown reason the vendor did not place this file
    inside /Sources even though this file is only intended to be used as an
    include. An attacker can combine his own server with the victim in such
    way that it would allow him/her to include remote arbitrary code on the
    victim's server and run it with web server permissions.

    DETAILS

    Vulnerable systems:
     * Yabb SE version 1.5.1 and prior

    The attack works as follows:
    ********
    .
    $dbcon = mysql_connect($db_server,$db_user,$db_passwd);
    mysql_select_db ($db_name);
    .
    ********

    First, we can see News.php is trying to connect to the SQL database. We
    can see that the variables above that contain the database information are
    not defined and may be changed by the attacker. If the attacker installs
    YabbSE on his/her server and allows a remote SQL connection, then News.php
    will think the database has been loaded successfully and run the following
    lines:

    ********
    .
    if ($template == null)
    include("news_template.php");
    else
    {
    if ($ext == null)
    include($template.".php");
    else
    include($template.".".$ext);
    }
    .
    ********

    Since template is never defined before, the attacker may inject into
    $template his/her own remote file. News.php will include the attacker's
    code, run it on the server, and give the attacker the ability to execute
    arbitrary code on the server with web server permissions.

    Solution:
    Please check the vendor's website for new patches. As a temporary solution
    rename News.php to News.inc and wait for vendor's reply.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:mindwarper@hush.com>
    mindwarper.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages