----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Gravity Board X Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA16342

VERIFY ADVISORY:
http://secunia.com/advisories/16342/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Cross Site Scripting, Manipulation of data, System
access

WHERE:
>From remote

SOFTWARE:
Gravity Board X (GBX) 1.x
http://secunia.com/product/5507/

DESCRIPTION:
rgod has discovered some vulnerabilities in Gravity Board X, which
can be exploited by malicious people to conduct cross-site scripting
attacks, bypass certain security restrictions, or compromise a
vulnerable system.

1) Input passed to the "email" parameter in index.php isn't properly
sanitised before being used in a SQL query. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation allows logon as administrator without
requiring knowledge of the password, but requires that
"magic_quotes_gpc" is disabled.

2) Input passed to the "board_id" parameter in deletethread.php isn't
properly sanitised before being returned to users. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

3) Missing access restrictions on the "editcss.php" script can be
exploited to include arbitrary PHP scripts in the style sheet.

The vulnerabilities have been confirmed in version 1.1. Other
versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly verified and
PHP scripts are removed before saving the updated style sheet.

PROVIDED AND/OR DISCOVERED BY:
rgod

ORIGINAL ADVISORY:
http://www.rgod.altervista.org/gravity.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------