Join our subscribers
PHP Code Injection in FUDforum
| Advisory ID: | HTB23146 |
| Product: | FUDforum |
| Vendor: | FUDforum |
| Vulnerable Versions: | 3.0.4 and probably prior |
| Tested Version: | 3.0.4 |
| Advisory Publication: | February 21, 2013 [without technical details] |
| Vendor Notification: | February 21, 2013 |
| Vendor Fix: | March 11, 2013 |
| Public Disclosure: | April 3, 2013 |
| Latest Update: | April 15, 2013 |
| Vulnerability Type: | Code Injection [CWE-94] |
| CVE Reference: | CVE-2013-2267 |
| Risk Level: | High |
 | |
| CVSSv2 Base Score: | 7.1 (AV:N/AC:H/Au:S/C:C/I:C/A:C) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge Security Research Lab discovered vulnerability in FUDforum, which can be exploited to execute arbitrary PHP code on the target system. | |
| Solution: | |
| Update: Install official vendor patch: http://sourceforge.net/apps/trac/fudforum/changeset/5602 History: Official Vendor patch is available here: http://fudforum.svn.sourceforge.net/fudforum/?rev=5596&view=rev However, the above-mentioned patch does not entirely fix the vulnerability, which can still be exploited by other exploitation techniques (such as NULL-byte and others). High-Tech Bridge Security Research Lab developed the following patch to eliminate the vulnerability: --- admreplace.php.old Mon Mar 04 15:46:02 2013 +++ admreplace.php Tue Mar 26 02:51:59 2013 @@ -18,9 +18,7 @@ if (!$_POST['rpl_replace_opt']) { - if ($_POST['rpl_preg_opt'] == 'e') { // Prevent code injection. - $_POST['rpl_preg_opt'] = 'i'; - } + if(false !== strpos($_POST['rpl_preg_opt'],'e')) { $_POST['rpl_preg_opt'] = 'i'; } $_POST['rpl_replace_str'] = '/'. $_POST['rpl_replace_str'] .'/'. $_POST['rpl_preg_opt']; $_POST['rpl_from_post'] = '/'. $_POST['rpl_from_post'] .'/'. $_POST['rpl_from_post_opt']; } else { @@ -184,7 +182,7 @@ if ($regex_str_opt == 'e') { $str = 'Code injection is not allowed!'; } else { - $str = preg_replace('/'. $regex_str .'/'. $regex_str_opt, $regex_with, $regex_src); + $str = preg_replace('/'. preg_quote($regex_str) .'/'. $regex_str_opt, $regex_with, $regex_src); Disclosure Timeline: 2013-02-21: Vendor notification. 2013-02-28: Secondary Vendor notification. 2013-03-03: Vendor patch. 2013-03-04: Vendor notification about patch bypasses. 2013-03-26: Vendor received our patch that eliminates the vulnerability. 2013-04-02: Still no modification of the official patch from the Vendor. 2013-04-03: Public Disclosure [Disclosure Policy]. 2013-04-14: Vendor provided final patch. | |
References: | |
| [1] High-Tech Bridge Advisory HTB23146 - https://www.immuniweb.com/advisory/HTB23146 - PHP Code Injection in FUDforum. [2] FUDforum - http://fudforum.org - FUDforum (Fast Uncompromising Discussion Forum) is a free and open source web discussion forum released under the GPL (version 2) license that is written in PHP and can be used on virtually any operating system. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
