[UNIX] YABB SE Allow Remote Command Execution

support_at_securiteam.com
Date: 04/26/03

  • Next message: support_at_securiteam.com: "[NEWS] UDP Bypassing in Kerio Firewall (UDP Scan)" 
    To: list@securiteam.com
Date: 26 Apr 2003 20:41:43 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    In the US?

    Contact Beyond Security at our new California office
    housewarming rates on automated network vulnerability
    scanning. We also welcome ISPs and other resellers!

    Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
    - - - - - - - - -

      YABB SE Allow Remote Command Execution
    ------------------------------------------------------------------------

    SUMMARY

    YABB SE is a popular bulletin board. It is based on a port of YABB to
    MySQL/PHP. YABB SE suffers a PHP injection vulnerability (remote command
    execution) in its 'language' support. Any registered user can execute
    commands with Web Server privileges (normally nobody).

    DETAILS

    Vulnerable systems:
     * YABB SE versions up to 1.5.1

    Immune systems:
     * YABB SE version 1.5.2 and later

    Any registered user can inject PHP code in YABB SE through its language
    support. YABB SE does an include($language) where $language is the
    selected language setting retrieved form the MySQL Database.

    In order to exploit this vulnerability, you must have a registered user,
    change your language setting through the "Change Profile" tab, using one
    Pen-Test Web Proxy such as HttPush, to an evil value.

    This action will update your language setting in the Database. Next
    queries will include your evil language setting.

    In order to inject PHP code, a malicious user could set the language
    variable to for example "http://zhodiac.net-dreamer.net/cmd.inc" where
    cmd.inc is the PHP code to inject.

    It is also possible to use this vulnerability to access any file on the
    server with Web Server privileges, only when safe_mode is disabled,
    setting the language variable for example to /etc/passwd.

    Recommendations:
    Upgrade to a newer YABB SE version (at least 1.5.2).

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:fjserna@ngsec.com> Fermín J.
    Serna.

    The original advisory can be downloaded from:
    <http://www.ngsec.com/docs/advisories/NGSEC-2003-5.txt>
    http://www.ngsec.com/docs/advisories/NGSEC-2003-5.txt.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: support_at_securiteam.com: "[NEWS] UDP Bypassing in Kerio Firewall (UDP Scan)"

    Relevant Pages