Secunia Research: MyBB "domecode()" PHP Code Execution Vulnerability
======================================================================
Secunia Research 12/06/2006
- MyBB "domecode()" PHP Code Execution Vulnerability -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10
======================================================================
1) Affected Software
MyBB 1.1.2
Prior versions may also be affected.
======================================================================
2) Severity
Rating: Highly critical
Impact: System access
Where: Remote
======================================================================
3) Vendor's Description of Software
MyBB is a powerful, efficient and free forum package developed in PHP
and MySQL. MyBB has been designed with the end users in mind, you and
your subscribers. Full control over your discussion system is
presented right at the tip of your fingers, from multiple styles and
themes to the ultimate customisation of your forums using the
template system.
Product link:
http://www.mybboard.com/
======================================================================
4) Description of Vulnerability
Secunia Research has discovered a vulnerability in MyBB, which can be
exploited by malicious people to compromise a vulnerable system.
Input passed to the username field when registering isn't properly
sanitised before being used in a "preg_replace" call with the "e"
modifier in the "domecode()" function in inc/functions_post.php. This
can be exploited to execute arbitrary PHP code by first registering
with a specially crafted username and then previewing a post
containing the "/slap" string.
The vulnerability has been confirmed in version 1.1.2. Prior versions
may also be affected.
======================================================================
5) Solution
Update to version 1.1.3.
http://www.mybboard.com/downloads.php
======================================================================
6) Time Table
06/06/2006 - Initial vendor notification.
06/06/2006 - Vendor confirms vulnerability.
12/06/2006 - Public disclosure.
======================================================================
7) Credits
Discovered by Andreas Sandblad, Secunia Research.
======================================================================
8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2006-2908 for the vulnerability.
======================================================================
9) About Secunia
Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:
http://secunia.com/
Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/secunia_security_advisories/
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-40/advisory/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================