bugtraq - Webfroot Shoutbox 2.32 directory traversal and code injection.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 29 May 2003 11:52:54 +0800
From: pokleyzz <pokleyzz@...n-associates.net>
To: vulnwatch@...nwatch.org, bugtraq@...urityfocus.com
Cc: tech@...n-associates.net
Subject: Webfroot Shoutbox 2.32 directory traversal and code injection.

Products: Webfroot Shoutbox v 2.32 and below (http://shoutbox.sf.net)
Date: 09 May 2003
Author:  pokleyzz <pokleyzz_at_scan-associates.net>
Contributors:	sk_at_scan-associates.net 
		shaharil_at_scan-associates.net 
		munir_at_scan-associates.net
URL: http://www.scan-associates.net

Summary: Webfroot Shoutbox 2.32 and below directory traversal and code injection.

Description
===========
Webfroot Shoutbox is PHP script released under the GPL. Also known as a tagboard 
or a blabbox, shoutboxes allow visitors to your website to leave messages to 
other visitors quickly and easily.

Details
=======
User can view any readable file on system where webfroot shoutbox is running using
$conf variable.

i) Shoutbox v2.32

shoutbox.php line 43
-------------------------------------------------------------------
if (!isset($conf)) {
   $conf="shoutboxconf.php";
} else {
   # michel v was there 
   $conf = str_replace(':', '', $conf); // hi cross-site scripting, bye cross-site scripting
   $conf = str_replace('%3a', '', $conf); // hi cross-site scripting, bye cross-site scripting
}

require_once ($conf);
-------------------------------------------------------------------

ii) Shoutbox v2.31

shoutbox.php line 43
-------------------------------------------------------------------
if (!isset($conf)) {
   $conf="shoutboxconf.php";
}

require_once ($conf);
--------------------------------------------------------------------

Proof of concept
================

a) View any readable file
	http://blablabla.com/shoutbox.php?conf=../../../../../../../etc/passwd

b) Remote command execution
	i)  for version 2.31 user can remotely include file.
	ii) version 2.32 user can use apache access_log to include php code
		[see attachment]
    

Workaround
==========
Append to line 48 of shoutbox.php
	$conf = str_replace('./', '', $conf); // to avoid directory traversal


Tips
====
Search for ":: Shoutbox" at www.google.com can easily identify vulnerable site (129,000 result)








Download attachment "jeritan_batinku.pl" of type "application/x-perl" (3313 bytes)