Home / vulnerabilities

PDF

MHL-2006-004.txt

Posted on 29 November 2006
Source : packetstormsecurity.org Link

 

MHL-2006-004 - Public Advisory

+-----------------------------------------------------------+
| mboard Security Issue |
+-----------------------------------------------------------+


PUBLISHED ON
November 26th, 2006


PUBLISHED AT
http://www.mayhemiclabs.com/advisories/MHL-2006-004.txt
http://www.mayhemiclabs.com/wiki/wikka.php?wakka=MHL2006004


PUBLISHED BY
Mayhemic Labs
http://www.mayhemiclabs.com

security AT mayhemiclabs DOT com
GPG key: 0x56143F84


APPLICATION
MBoard - PHP message board
http://www.phpjunkyard.com/php-message-board.php

"MBoard is a PHP message board script (a simple forum)."


AFFECTED VERSIONS
Versions 1.22 and below


ISSUES
MBoard does not check the Post ID for malicious data when replying,
allowing an attacker to create blank files on the system wherever
the web server has write access.

Example: An attacker can reply to a message, and edit the "orig_id"
variable to something malicious ("../../../../../../tmp/ZOMGHAX")
mboard will then create the specified file (appending the
configured extension.

WORKAROUNDS
Enabling Magic Quotes will negate the issue.


SOLUTIONS
Upgrade to version 1.3


REFERENCES
MBoard - http://www.phpjunkyard.com/php-message-board.php


TIMELINE
October 11th, 2006
Vendor/Developer Notified
Vendor/Developer Response Recieved

October 25th, 2006
Vendor/Developer Followup
Vendor/Developer Response Recieved

November 16th, 2006
Vendor/Developer Followup

November 18th, 2006
New Version Released

November 26th, 2006
Advisory Released


ADDITIONAL CREDIT
N/A

LICENSE
Creative Commons Attribution-ShareAlike License
http://creativecommons.org/licenses/by-sa/2.5

 

TOP