[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20111009103526.25166a06@laverne>
Date: Sun, 9 Oct 2011 10:35:26 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: CVE request: CSRF and file inclusion in usebb before 1.0.12
http://www.usebb.net/community/topic-2571.html
Vulnerability "HTB22914: Local File Inclusion in UseBB"
Recently, High-Tech Bridge SA discovered a possible issue in UseBB
1.0.11 and earlier. The issue exists in the fact that admin.php may
possibly include PHP files not used for the UseBB admin control panel
(ACP).
The faulty code in question is only executed for logged in
administrator accounts, and can only include non-relevant PHP files if
a directory "sources/admin_" exists, which is not the case in UseBB 1.
Therefore, the issue does not pose a direct threat to an existing UseBB
set-up, but is classified a security issue anyway and has been fixed in
UseBB 1.0.12.
Vulnerability "HTB22913: Multiple CSRF (Cross-Site Request Forgery) in
UseBB"
High-Tech Bridge SA also discovered possibilities of executing CSRF
attacks in UseBB 1.0.11 and earlier. This way, when a user is given a
malicious URL or visits a web page containing such URL or JavaScript,
requests may be executed that add, edit or delete data on the forum,
including topics, posts, account information and settings in the ACP
(if the user has logged in into the ACP).
As a solution, UseBB 1.0.12 has implemented URL and form tokens for
sensitive actions. Accessing or executing above URLs or scripts now
doesn't have an effect on the data.
--
Hanno Böck mail/jabber: hanno@...eck.de
GPG: BBB51E42 http://www.hboeck.de/
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
