BID:10701

phpBB Viewtopic.PHP PHP Script Injection Vulnerability

Info

phpBB Viewtopic.PHP PHP Script Injection Vulnerability

Bugtraq ID:	10701
Class:	Input Validation Error
CVE:	CVE-2004-1315
Remote:	Yes
Local:	No
Published:	Jul 12 2004 12:00AM
Updated:	May 05 2010 08:52AM
Credit:	Discovery of this vulnerability is credited to sasan hezarkhani <[email protected]>.
Vulnerable:	PNphpBB PNphpBB 1.2 g PNphpBB PNphpBB 1.2 f PNphpBB PNphpBB 1.2 phpBB Group phpBB 2.0.8 phpBB Group phpBB 2.0.7 a phpBB Group phpBB 2.0.7 phpBB Group phpBB 2.0.6 d phpBB Group phpBB 2.0.6 c phpBB Group phpBB 2.0.6 phpBB Group phpBB 2.0.5 phpBB Group phpBB 2.0.4 phpBB Group phpBB 2.0.3 phpBB Group phpBB 2.0.2 phpBB Group phpBB 2.0.1 phpBB Group phpBB 2.0 .0 phpBB Group phpBB 2.0 RC4 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC3 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC2 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC1 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 Beta 1 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 1.4.4 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 1.4.2 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 1.4.1 phpBB Group phpBB 1.4 .0 phpBB Group phpBB 1.2.1 phpBB Group phpBB 1.2 .0 phpBB Group phpBB 1.0 .0 PHP-Nuke PHP-Nuke 7.9 PHP-Nuke PHP-Nuke 7.8 PHP-Nuke PHP-Nuke 7.7 PHP-Nuke PHP-Nuke 7.6 PHP-Nuke PHP-Nuke 7.5 PHP-Nuke PHP-Nuke 7.4 PHP-Nuke PHP-Nuke 7.3 PHP-Nuke PHP-Nuke 7.2 PHP-Nuke PHP-Nuke 7.1 PHP-Nuke PHP-Nuke 7.0 Gentoo Linux

Not Vulnerable:	phpBB Group phpBB 2.0.11

Discussion

phpBB Viewtopic.PHP PHP Script Injection Vulnerability

The 'viewtopic.php' phpBB script is prone to a remote PHP script injection vulnerability because the application fails to properly sanitize user-supplied URI parameters before using them to construct dynamically generated web pages.

Exploiting this issue may allow a remote attacker to execute arbitrary commands in the context of the webserver that is hosting the vulnerable software.

Exploit / POC

phpBB Viewtopic.PHP PHP Script Injection Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following example is available:

http://www.example.com/forums/viewtopic.php?t=[NUMBER HERE]&highlight=Bug,SELECT * FROM $table
http://www.example.com/viewtopic.php?t=29040&highlight=%2527%252esystem(chr(108)%252echr(115))%252e%2527

The following exploits are also available:

/data/vulnerabilities/exploits/phpBBCodeExecExploitRUSH.pl
/data/vulnerabilities/exploits/phpbb_urldecode_poc.pl

Solution / Fix

phpBB Viewtopic.PHP PHP Script Injection Vulnerability

Solution:
The vendor has released an update to address this vulnerability. Please see the references for more information.

phpBB Group phpBB 1.0 .0