ekinboard Multiple Authentication Bypass And Arbitrary File Upload Vulnerabilities

Bugtraq ID:	27166
Class:	Input Validation Error
CVE:	CVE-2008-7157 CVE-2008-7156
Remote:	Yes
Local:	No
Published:	Jan 07 2008 12:00AM
Updated:	Jul 05 2016 10:00PM
Credit:	Eugene Minaev <[email protected]> discovered this issue.
Vulnerable:	Ekinboard Ekinboard 1.1
Not Vulnerable:

ekinboard Multiple Authentication Bypass And Arbitrary File Upload Vulnerabilities

The 'ekinboard' program is prone to multiple authentication-bypass vulnerabilities and an arbitrary-file-upload vulnerability because it fails to adequately sanitize user-supplied input.

Attackers can leverage these issues to gain unauthorized access to the application and to execute arbitrary code in the context of the application.

These issues affect ekinboard 1.1.0; other versions may also be affected.

ekinboard Multiple Authentication Bypass And Arbitrary File Upload Vulnerabilities

Attackers can exploit these issues using a web browser.

The following example URI is available:

http://www.example.com/skvoznoy/backup.php?_groups[]=2

ekinboard Multiple Authentication Bypass And Arbitrary File Upload Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ekinboard Multiple Authentication Bypass And Arbitrary File Upload Vulnerabilities

References:

• Ekinboard Homepage (Ekinboard)