Phorum 3.0.7 auth.php3 Backdoor Vulnerabililty
BID:2274
Info
Phorum 3.0.7 auth.php3 Backdoor Vulnerabililty
| Bugtraq ID: | 2274 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 06 2000 12:00AM |
| Updated: | Jan 06 2000 12:00AM |
| Credit: | This vulnerability was announced to Bugtraq by Max Vision <[email protected]> on January 6, 2000, and was originally discovered by Jfs <[email protected]> . |
| Vulnerable: |
Brian Moon Phorum 3.0.7 |
| Not Vulnerable: | |
Discussion
Phorum 3.0.7 auth.php3 Backdoor Vulnerabililty
Phorum is a freely available, open source, popular WWW Board written by Brian Moon. It is designed to enhance the services offered on a web page, allow users to interact with one another through bulletin board chat and discussion.
A problem with the package allows users access to any resources within the bulletin board system. Any file that is access controlled by the auth.php3 script may be accessed, due to a backdoor password written into the script auth.php3. The password "boogieman" will permit users to access files controlled by auth.php3 by simply appending the variable PHP_AUTH_USER=boogieman to the URL. This makes it possible for users with malicious intentions to access any file under the access control of auth.php3, and potentially gain elevated privileges, including access to the local system.
Phorum is a freely available, open source, popular WWW Board written by Brian Moon. It is designed to enhance the services offered on a web page, allow users to interact with one another through bulletin board chat and discussion.
A problem with the package allows users access to any resources within the bulletin board system. Any file that is access controlled by the auth.php3 script may be accessed, due to a backdoor password written into the script auth.php3. The password "boogieman" will permit users to access files controlled by auth.php3 by simply appending the variable PHP_AUTH_USER=boogieman to the URL. This makes it possible for users with malicious intentions to access any file under the access control of auth.php3, and potentially gain elevated privileges, including access to the local system.
Exploit / POC
Phorum 3.0.7 auth.php3 Backdoor Vulnerabililty
This vulnerability can be exploited by appending the PHP_USER_AUTH variable to the URL with the password "boogieman" as the value.
http://some.host.com/admin.php3
This file would not be accessible by the unauthenticated user. However,
http://some.host.com/admin.php3?PHP_AUTH_USER=boogieman
will permit access to this file.
This vulnerability can be exploited by appending the PHP_USER_AUTH variable to the URL with the password "boogieman" as the value.
http://some.host.com/admin.php3
This file would not be accessible by the unauthenticated user. However,
http://some.host.com/admin.php3?PHP_AUTH_USER=boogieman
will permit access to this file.
Solution / Fix
Phorum 3.0.7 auth.php3 Backdoor Vulnerabililty
Solution:
Upgrade available:
Brian Moon Phorum 3.0.7
Solution:
Upgrade available:
Brian Moon Phorum 3.0.7
-
Brian Moon Phorum 3.2.11
http://phorum.sourceforge.net/downloads/phorum-3.2.11.tar.gz
References
Phorum 3.0.7 auth.php3 Backdoor Vulnerabililty
References:
References: