BID:14086

phpBB 'viewtopic.php' Remote Code Execution Vulnerability

Info

phpBB 'viewtopic.php' Remote Code Execution Vulnerability

Bugtraq ID:	14086
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 28 2005 12:00AM
Updated:	Mar 19 2015 08:49AM
Credit:	Discovery of this vulnerability is credited to ronvdaal <[email protected]>.
Vulnerable:	PNphpBB PNphpBB 1.2 g PNphpBB PNphpBB 1.2 f PNphpBB PNphpBB 1.2 phpBB Group phpBB 2.0.15 phpBB Group phpBB 2.0.14 phpBB Group phpBB 2.0.13 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 alpha + Debian Linux 3.1 phpBB Group phpBB 2.0.12 phpBB Group phpBB 2.0.11 phpBB Group phpBB 2.0.10 phpBB Group phpBB 2.0.9 phpBB Group phpBB 2.0.8 a phpBB Group phpBB 2.0.8 phpBB Group phpBB 2.0.7 a phpBB Group phpBB 2.0.7 phpBB Group phpBB 2.0.6 d phpBB Group phpBB 2.0.6 c phpBB Group phpBB 2.0.6 phpBB Group phpBB 2.0.5 phpBB Group phpBB 2.0.4 phpBB Group phpBB 2.0.3 phpBB Group phpBB 2.0.2 phpBB Group phpBB 2.0.1 phpBB Group phpBB 2.0 .0 phpBB Group phpBB 2.0 RC4 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC3 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC2 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC1 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 Beta 1 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 1.4.4 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 1.4.2 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 1.4.1 phpBB Group phpBB 1.4 .0 phpBB Group phpBB 1.2.1 phpBB Group phpBB 1.2 .0 phpBB Group phpBB 1.0 .0 Gentoo Linux

Not Vulnerable:	phpBB Group phpBB 2.0.16 phpBB Group phpBB 2.0.11

Discussion

phpBB 'viewtopic.php' Remote Code Execution Vulnerability

The 'viewtopic.php' phpBB script is prone to a remote script-injection vulnerability because the application fails to properly sanitize user-supplied URI parameters before using them to construct dynamically generated web pages.

This issue may allow a remote attacker to execute arbitrary commands in the context of the webserver that is hosting the vulnerable software.

Exploit / POC

phpBB 'viewtopic.php' Remote Code Execution Vulnerability

The following example is available:

http://www.example.com/phpbb2.0.15/viewtopic.php?t=2&highlight='.printf(123456).'

dab <[email protected]> has supplied the following exploit (phpbb2_0_15.pl), [email protected] has supplied the exploit (rattle.py), SecureD <[email protected]> has supplied the exploit (phpbbSecureD.pl),
st0ke at milw0rm.com has supplied the exploit (phpBB2.0.15-comm-exec.exp.pl), valsmith <[email protected]> and H D Moore <[email protected]> have supplied the Metasploit Framework exploit (phpbb_highlight.pm):

/data/vulnerabilities/exploits/phpBBCodeExecExploitRUSH.pl
/data/vulnerabilities/exploits/phpbb_urldecode_poc.pl
/data/vulnerabilities/exploits/phpbb2_0_15.pl
/data/vulnerabilities/exploits/rattle.py
/data/vulnerabilities/exploits/phpbbSecureD.pl
/data/vulnerabilities/exploits/phpBB2.0.15-comm-exec.exp.pl
/data/vulnerabilities/exploits/phpbb_highlight.pm

Solution / Fix

phpBB 'viewtopic.php' Remote Code Execution Vulnerability

Solution:
The vendor has released an update to address this vulnerability.

Gentoo Linux has released security advisory GLSA 200507-03 addressing this issue. Please see the referenced advisory for more information.

phpBB Group phpBB 1.0 .0