Ultimate PHP Board admin_iplog.PHP Arbitrary PHP Execution Vulnerability
BID:7678
Info
Ultimate PHP Board admin_iplog.PHP Arbitrary PHP Execution Vulnerability
| Bugtraq ID: | 7678 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 24 2003 12:00AM |
| Updated: | May 24 2003 12:00AM |
| Credit: | The discovery of this vulnerability has been credited to "euronymous" <[email protected]>. |
| Vulnerable: |
Ultimate PHP Board Ultimate PHP Board 1.9 |
| Not Vulnerable: | |
Discussion
Ultimate PHP Board admin_iplog.PHP Arbitrary PHP Execution Vulnerability
A vulnerability has been reported in Ultimate PHP Board. The problem is said to occur due to insufficient sanitization of user-supplied input before including log data into a PHP file. As a result, it may be possible for a remote attacker to execute arbitrary PHP commands within the context of the web server. The execution of these commands would only occur when an administrator chooses to view the log of forum activity via the 'admin_iplog.php' script.
A vulnerability has been reported in Ultimate PHP Board. The problem is said to occur due to insufficient sanitization of user-supplied input before including log data into a PHP file. As a result, it may be possible for a remote attacker to execute arbitrary PHP commands within the context of the web server. The execution of these commands would only occur when an administrator chooses to view the log of forum activity via the 'admin_iplog.php' script.
Exploit / POC
Ultimate PHP Board admin_iplog.PHP Arbitrary PHP Execution Vulnerability
The following proof of concept has been supplied:
$ telnet www.target.org 80
Connected to www.target.org at 80
GET /board/index.php HTTP/1.0
User-Agent: <? phpinfo(); ?>
The following proof of concept has been supplied:
$ telnet www.target.org 80
Connected to www.target.org at 80
GET /board/index.php HTTP/1.0
User-Agent: <? phpinfo(); ?>
Solution / Fix
Ultimate PHP Board admin_iplog.PHP Arbitrary PHP Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Ultimate PHP Board admin_iplog.PHP Arbitrary PHP Execution Vulnerability
References:
References:
- Ultimate PHP Board Homepage (Ultimate PHP Board)
- UPB: Discussion Board/Web-Site Takeover ("euronymous"