From: Secunia Security Advisories (sec-advsecunia.com)
Date: Mon May 12 2003 - 08:11:05 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
YaBB Execution of Arbitrary Code

READ ONLINE:
http://www.secunia.com/advisories/8762/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
From remote

SOFTWARE:
YaBB SE 1.x

DESCRIPTION:
A vulnerability has been identified in YaBB SE allowing malicious
people to execute arbitrary PHP code on the web server.

The problem is that the "sourcedir" variable in "SSI.php" isn't
verfied before it is used in an "include_once" function call. This
allows malicious users to supply a path to a remote web server with
malicious versions of "Errors.php", "Subs.php" and "Load.php".

This was confirmed in version 1.5.2

SOLUTION:
Edit the source code so that remote users can't manipulate the
"sourcedir" variable or hardcode the path.

REPORTED BY / CREDITS:
Dalibor Karlovic & DownBload

----------------------------------------------------------------------

Secunia recommends that you verify all advisories you receive, by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

Contact details:
Web : http://www.secunia.com/
E-mail : supportsecunia.com
Tel : +44 (0) 20 7016 2693
Fax : +44 (0) 20 7637 0419

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]