Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web BBS :: etc :: bt390.txt

Several bugs found in "Spyke's PHP Board"


Advisory Information
Advisory Name      : Several bugs found in "Spyke's PHP Board"
Author             : Marc Bromm <> Germany
Discover by        : Marc Bromm <> Germany
Release Date       : 9. June 2003
Application        : Spyke's PHP Board (textfile based board)
Vendor Homepage    :
Vulnerable Versions: v2.1 (maybe older)
Platforms          : OS Independent, PHP
Severity           : High 


"Spyke's PHP Board" is a small textfile based PHP board. You have to
register to write messages. Also an admin area exist. There you can
add/delete threads, add/delete topics. 
The website is the official website where you can get


1. Get userinformation
All information of a user like password (plaintext), e-mail, icq number,
signatur ... are stored in textfiles in the directory "user/".
Every file has the name of the user.

So if you register as "theblacksheep" your information are stored in:


So it is possible for you to open the files with your browser to get the

2. Get the admin password and username

In the root directory you can find a file called "info.dat". It looks

	$boardname="Spykes PHP Board";
	$phpendung = ".php";

So only open this file with your browser and get the admin information.
Then you can log in as admin. So you have full control.

Also some more bugs exist. So it is also possible to:

--> Create topic in not existing thread (found by DigitalAcid)
--> Change anyone's account without knowing their password (FirebirdGM)


It is not possible to fix that holes. (You can do it but then you have to
change everything [how the whole information are stored]) 

######Vendor Response:

For "Spyke PHP Board" no support exist.

Greetz to:

erik, FirebirdGM, DigitalAcid


-- - Or how I learned to stop worrying and
                          love email again

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH