bugtraq - Invision Power Board 2.1.4 Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060221165314.17281.qmail@securityfocus.com>
Date: 21 Feb 2006 16:53:14 -0000
From: paisterist.nst@...il.com
To: bugtraq@...urityfocus.com
Subject: Invision Power Board 2.1.4 Multiple Vulnerabilities


/*
--------------------------------------------------------
[N]eo [S]ecurity [T]eam [NST]® - Advisory #16 - 18/02/06
--------------------------------------------------------
Program: Invision Power Board 2.1.4
Homepage: http://www.invisionboard.com
Vulnerable Versions: 2.1.4 & Lower versions
Risk: Low Risk!!
Impact: Multiple Vulnerabilities.

-==Invision Power Board 2.1.4 Multiple Vulnerabilities==-
---------------------------------------------------------

- Description
---------------------------------------------------------
Invision Power Board, an award-winning scaleable bulletin 
board system, allows you to effortlessly build, manage and 
promote your online community. Advanced yet intuitive features 
like multi-moderation allow you to focus on developing your 
community, rather than wrestling with complex settings.

- Tested
---------------------------------------------------------
localhost & many forums

- Explotation
---------------------------------------------------------
-==Multiple Full Path Disclosure Vulnerabilities==-

ips_kernel/PEAR/Text/Diff/Renderer/inline.php
ips_kernel/PEAR/Text/Diff/Renderer/unified.php
ips_kernel/PEAR/Text/Diff3.php
ips_kernel/class_db.php
ips_kernel/class_db_mysql.php
ips_kernel/class_xml.php
sources/sql/mysql_admin_queries.php
sources/sql/mysql_extra_queries.php
sources/sql/mysql_queries.php
sources/sql/mysql_subsm_queries.php
sources/acp_loaders/acp_pages_components.php
sources/action_admin/member.php
sources/action_admin/paysubscriptions.php
sources/action_public/login.php
sources/action_public/messenger.php
sources/action_public/moderate.php
sources/action_public/paysubscriptions.php
sources/action_public/register.php
sources/action_public/search.php
sources/action_public/topics.php
sources/action_public/usercp.php
sources/classes/bbcode/class_bbcode.php
sources/classes/bbcode/class_bbcode_legacy.php
sources/classes/editor/class_editor_rte.php
sources/classes/editor/class_editor_std.php
sources/classes/post/class_post.php
sources/classes/post/class_post_edit.php
sources/classes/post/class_post_new.php
sources/classes/post/class_post_reply.php
sources/components_acp/registration_DEPR.php
sources/handlers/han_paysubscriptions.php
sources/lib/func_usercp.php
sources/lib/search_mysql_ftext.php
sources/lib/search_mysql_man.php
sources/loginauth/convert/auth.php.bak
sources/loginauth/external/auth.php
sources/loginauth/ldap/auth.php


-==Multiple Directory Listing Vulnerabilities==-

sources/loginauth/convert/
sources/portal_plugins/
cache/skin_cache/cacheid_2/
ips_kernel/PEAR/
ips_kernel/PEAR/Text/
ips_kernel/PEAR/Text/Diff/
ips_kernel/PEAR/Text/Diff/Renderer/
style_images/1/folder_rte_files/
style_images/1/folder_js_skin/
style_images/1/folder_rte_images/
upgrade/*/

The directory listing are not relevant, but with the full path disclosures you can get the path of the forum into the server.

- References
--------------------------------------------------------
http://neosecurityteam.net/advisories/Advisory-16.txt
http://neosecurityteam.net/index.php?action=advisories&id=16

- Solution
--------------------------------------------------------
Not yet, don't worry, this is no very unsecure.


- Credits
-------------------------------------------------
Discovered by Paisterist <paisterist.nst@...il.com>

[N]eo [S]ecurity [T]eam [NST]® - http://neosecurityteam.net/

Got Questions? http://neosecurityteam.net/foro/


- Greets
--------------------------------------------------------
HaCkZaTaN
Daemon21
K4P0
Link
LINUX
erg0t

And the latin people

@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@
'@@@@@''@@'@@@''''''''@@''@@@''@@
'@@'@@@@@@''@@@@@@@@@'''''@@@
'@@'''@@@@'''''''''@@@''''@@@
@@@@''''@@'@@@@@@@@@@''''@@@@@
*/

/* EOF */