Yxbbs forum system 3.1.0 filename parameter Arbitrary File Download Vulnerability and repair

Affected Versions:

Ver 3.1.0

Vulnerability description:

Yxbbs is an open-source and free community forum system program developed by Y. It adopts asp + Access (SQL) technology. viewFile. the filename parameter is not verified and filtered in Asp. serious security problems exist. The default database is the asa suffix, And the <% loop <% anti-download code is added to it. An error occurs when you directly access the database file. The Arbitrary File Download Vulnerability is invalid. That is to say, the database with the asa suffix cannot be downloaded. If the Postfix is changed, for example, to. mdb, The postfix can be downloaded. You can test it by yourself.

<* Reference

Http://www.t00ls.net
Http://sebug.net/

*>Test method:
The Program (method) provided on this site may be offensive and only used for security research and teaching. You are at your own risk!

/Article/previusfile/Article/201007/20100721103040248 .jpg

Security suggestions:

Manufacturer Patch: Yxbbs: http://www.yimxu.com/bbs/Show.Asp? ID = 7388