Gravity Board X CSS Template Unauthorized Access Vulnerability
BID:14502
Info
Gravity Board X CSS Template Unauthorized Access Vulnerability
| Bugtraq ID: | 14502 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 08 2005 12:00AM |
| Updated: | Aug 08 2005 12:00AM |
| Credit: | rgod is credited with the discovery of this vulnerability. |
| Vulnerable: |
Gravity Board X GBX 1.1 |
| Not Vulnerable: | |
Discussion
Gravity Board X CSS Template Unauthorized Access Vulnerability
Gravity Board X (GBX) is affected by an unauthorized access vulnerability. This issue is due to a failure in the application to perform proper access validation before granting access to privileged functions.
An attacker can exploit this vulnerability and modify an existing CSS template to include arbitrary PHP code. The attacker can then call the stored template and have the malicious PHP code executed in the context of the Web server process. This may aid the attacker in further attacks against the underlying system.
Gravity Board X (GBX) is affected by an unauthorized access vulnerability. This issue is due to a failure in the application to perform proper access validation before granting access to privileged functions.
An attacker can exploit this vulnerability and modify an existing CSS template to include arbitrary PHP code. The attacker can then call the stored template and have the malicious PHP code executed in the context of the Web server process. This may aid the attacker in further attacks against the underlying system.
Exploit / POC
Gravity Board X CSS Template Unauthorized Access Vulnerability
No exploit is required.
The following exploit is available which permits an attacker the ability to execute arbitrary commands on the affected system through exploitation of this vulnerability:
No exploit is required.
The following exploit is available which permits an attacker the ability to execute arbitrary commands on the affected system through exploitation of this vulnerability:
Solution / Fix
Gravity Board X CSS Template Unauthorized Access Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Gravity Board X CSS Template Unauthorized Access Vulnerability
References:
References:
- GBX Homepage (Gravity Board X)
- Gravity Board X v1.1 multiple vulnerabilities ([email protected])