The two latest vulnerabilities of ipb

5up3rh3iblog

Vulnerability announcement

1. Local Inclusion Vulnerability

This is mainly because ipb's self-implemented friendly URLs function does not completely filter the url parameters. [or excessively dependent on IPSLib: cleanGlobals filtering, but this parameter is ignored]. the author's vulnerability announcement provides detailed code analysis for ipb 3.04. Let's take a look at ipb 3.0. [0-3]. according to the author's vulnerability analysis, the vulnerability is mainly in function _ fUrlInit:

UploadadminsourcesaseipsRegistry. php

Private static function _ fUrlInit ()
{
If (ipsRegistry: $ settings [use_friendly_urls]) // The default value is 1.
{

......

/* Grab FURL data ...*/
If (file_exists (IPS_CACHE_PATH. cache/furlCache. php ))
{
Require (IPS_CACHE_PATH. cache/furlCache. php );
Self: $ _ seoTemplates = $ templates;
}
.....

If (is_array (self ::$ _ seoTemplates) AND count (self ::$ _ seoTemplates) AND IPS_IS_TASK! = True and IPS_IS_AJAX! = TRUE)
{
$ Qs = $ _ SERVER [QUERY_STRING]? $ _ SERVER [QUERY_STRING]: @ getenv (QUERY_STRING );
$ Uri = $ _ SERVER [REQUEST_URI]? $ _ SERVER [REQUEST_URI]: @ getenv (REQUEST_URI );

$ _ ToTest = ($ qs )? $ Qs: $ uri; // obtain the url parameter through $ _ SERVER [QUERY_STRING]/@ getenv (QUERY_STRING). It is estimated that $ _ SERVER/getenv is extracted
// The variable is not processed by magic quotes. [For details, see <advanced PHP application vulnerability Review Technology>? This is also
// Indicates the use point of exp in 3.04.

Foreach (self ::$ _ seoTemplates as $ key => $ data)
{

.....

If (strstr ($ _ toTest, self: $ _ seoTemplates [_ data _] [varBlock])
{
$ _ Parse = substr ($ _ toTest, strpos ($ _ toTest, self ::$ _ seoTemplates [_ data _] [varBlock]) + strlen (self :: $ _ seoTemplates [_ data _] [varBlock]);

$ _ Data = explode (self: $ _ seoTemplates [_ data _] [varSep], $ _ parse );
// Extract parameters separately
// Self: $ _ seoTemplates [_ data _] [varBlock], self: $ _ seoTemplates [_ data _] [varSep] and other variables are
// Extract in require (IPS_CACHE_PATH. cache/furlCache. php:
//
// _ Data _ =>
// Array (
// Start => -,
// End => /,
// VarBlock =>/page __,
// VarSep => __,


$ _ C = 0;

Foreach ($ _ data as $ _ v)
{
If (! $ _ C)
{
$ K = IPSText: parseCleanKey ($ _ v );
$ V =;
$ _ C ++;
}
Else
{
$ V = IPSText: parseCleanValue ($ _ v );
$ _ C = 0;

$ _ GET [$ k] = $ v;
$ _ POST [$ k] = $ v;
$ _ REQUEST [$ k] = $ v;
$ _ UrlBits [$ k] = $ v;

IpsRegistry: $ request [$ k] = $ v;
} // The final extracted variables are filtered by IPSText: parseCleanValue and extracted. IPSText: parseCleanValue is only used to filter some special words injected by xss SQL.
// Character and no filter ../



Although $ _ SERVER [QUERY_STRING] is not controlled by magic quotes in php5, it is recorded by urlencode, so it is difficult to submit % 00 truncation. however, we can use extra-long/or other characters to truncation.

2 Injection Vulnerability

Another typical security vulnerability caused by improper use of intval (), please refer to [PCH-001] For details



These two vulnerabilities are discovered only when you fully understand the functions and handling processes of the target program...