Products: Webfroot Shoutbox v 2.32 and below (http://shoutbox.sf.net) Date: 09 May 2003 Author: pokleyzz <pokleyzz_at_scan-associates.net> Contributors: sk_at_scan-associates.net shaharil_at_scan-associates.net munir_at_scan-associates.net URL: http://www.scan-associates.net Summary: Webfroot Shoutbox 2.32 and below directory traversal and code injection. Description =========== Webfroot Shoutbox is PHP script released under the GPL. Also known as a tagboard or a blabbox, shoutboxes allow visitors to your website to leave messages to other visitors quickly and easily. Details ======= User can view any readable file on system where webfroot shoutbox is running using $conf variable. i) Shoutbox v2.32 shoutbox.php line 43 ------------------------------------------------------------------- if (!isset($conf)) { $conf="shoutboxconf.php"; } else { # michel v was there $conf = str_replace(':', '', $conf); // hi cross-site scripting, bye cross-site scripting $conf = str_replace('%3a', '', $conf); // hi cross-site scripting, bye cross-site scripting } require_once ($conf); ------------------------------------------------------------------- ii) Shoutbox v2.31 shoutbox.php line 43 ------------------------------------------------------------------- if (!isset($conf)) { $conf="shoutboxconf.php"; } require_once ($conf); -------------------------------------------------------------------- Proof of concept ================ a) View any readable file http://blablabla.com/shoutbox.php?conf=../../../../../../../etc/passwd b) Remote command execution i) for version 2.31 user can remotely include file. ii) version 2.32 user can use apache access_log to include php code [see attachment] Workaround ========== Append to line 48 of shoutbox.php $conf = str_replace('./', '', $conf); // to avoid directory traversal Tips ==== Search for ":: Shoutbox" at www.google.com can easily identify vulnerable site (129,000 result)
This archive was generated by hypermail 2b30 : Thu May 29 2003 - 23:50:16 PDT