UBBThreads/WWWThreads Arbitrary File Upload Vulnerability
BID:3993
Info
UBBThreads/WWWThreads Arbitrary File Upload Vulnerability
| Bugtraq ID: | 3993 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0223 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 30 2002 12:00AM |
| Updated: | Jul 11 2009 09:56AM |
| Credit: | This issue was submitted to BugTraq by Root Extractor <[email protected]> on January 30th, 2002. |
| Vulnerable: |
Wired Community Software WWWThreads 5.0 .9 Wired Community Software WWWThreads 5.0 .8 Wired Community Software WWWThreads 5.0 .6 Wired Community Software WWWThreads 5.0 Infopop UBBThreads 5.4 |
| Not Vulnerable: |
Infopop UBBThreads 5.5 |
Discussion
UBBThreads/WWWThreads Arbitrary File Upload Vulnerability
UBBThreads is a customizable, commercial database-driven message board. Seperate versions are available in both PHP and Perl. UBBThreads used to be called WWWThreads before being acquired and repackaged by Infopop from its previous maintainer Wired Community Software. Sites running UBBThreads and WWWThreads should be considered prone to this issue. UBBThreads/WWWThreads will run on most Unix and Linux variants, in addition to Microsoft Windows NT/2000 operating systems.
UBBThreads/WWWThreads allows users to upload certain types of files to the message board. For example, users may upload .txt, .jpg, .bmp, or .zip files.
However, a vulnerability has been discovered which may allow a remote attacker to upload arbitrary files. If the attacker adds a second file extension, only the first file extension will be checked by the message board. For example, a file entitled "file.txt.php" will pass through the filter, as the message board will assume it is of a permitted file type based on the first file extension.
In the case of a malicious PHP script, it may be possible for the attacker to execute it via the message board interface.
This issue reportedly affects the PHP version of the software.
UBBThreads is a customizable, commercial database-driven message board. Seperate versions are available in both PHP and Perl. UBBThreads used to be called WWWThreads before being acquired and repackaged by Infopop from its previous maintainer Wired Community Software. Sites running UBBThreads and WWWThreads should be considered prone to this issue. UBBThreads/WWWThreads will run on most Unix and Linux variants, in addition to Microsoft Windows NT/2000 operating systems.
UBBThreads/WWWThreads allows users to upload certain types of files to the message board. For example, users may upload .txt, .jpg, .bmp, or .zip files.
However, a vulnerability has been discovered which may allow a remote attacker to upload arbitrary files. If the attacker adds a second file extension, only the first file extension will be checked by the message board. For example, a file entitled "file.txt.php" will pass through the filter, as the message board will assume it is of a permitted file type based on the first file extension.
In the case of a malicious PHP script, it may be possible for the attacker to execute it via the message board interface.
This issue reportedly affects the PHP version of the software.
Exploit / POC
UBBThreads/WWWThreads Arbitrary File Upload Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
UBBThreads/WWWThreads Arbitrary File Upload Vulnerability
Solution:
This issue has been addressed in UBBThreads versions 5.5 and later.
Information about upgrading can be found here:
http://www.infopop.com/support/ubbthreads/index.html
Solution:
This issue has been addressed in UBBThreads versions 5.5 and later.
Information about upgrading can be found here:
http://www.infopop.com/support/ubbthreads/index.html
References
UBBThreads/WWWThreads Arbitrary File Upload Vulnerability
References:
References:
- UBBThreads Product Page (Infopop)