Date: 09 May 2003
Author: pokleyzz <pokleyzz_at_scan-associates.net>
Contributors: sk_at_scan-associates.net shaharil_at_scan-associates.net munir_at_scan-associates.net
URL: http://www.scan-associates.net
Summary: Webfroot Shoutbox 2.32 and below directory traversal and code injection.
Description
===========
Webfroot Shoutbox is PHP script released under the GPL. Also known as a tagboard or a blabbox, shoutboxes allow visitors to your website to leave messages to other visitors quickly and easily.
Details ======= User can view any readable file on system where webfroot shoutbox is running using $conf variable.
i) Shoutbox v2.32
shoutbox.php line 43
-------------------------------------------------------------------
if (!isset($conf)) {
$conf="shoutboxconf.php";
} else {
# michel v was there $conf = str_replace(':', '', $conf); // hi cross-site scripting, bye cross-site scripting
$conf = str_replace('%3a', '', $conf); // hi cross-site scripting, bye cross-site scripting
}
require_once ($conf); -------------------------------------------------------------------
ii) Shoutbox v2.31
shoutbox.php line 43
-------------------------------------------------------------------
if (!isset($conf)) {
$conf="shoutboxconf.php";
}require_once ($conf); --------------------------------------------------------------------
Proof of concept ================
a) View any readable file http://blablabla.com/shoutbox.php?conf=../../../../../../../etc/passwd
b) Remote command execution
i) for version 2.31 user can remotely include file.
ii) version 2.32 user can use apache access_log to include php code
[see attachment]
Workaround
==========
Append to line 48 of shoutbox.php
$conf = str_replace('./', '', $conf); // to avoid directory traversal
Tips ==== Search for ":: Shoutbox" at www.google.com can easily identify vulnerable site (129,000 result)
Attachment:
jeritan_batinku.pl
Description: Perl program
