Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web BBS :: etc :: hack7197.htm

GNUBoard File extensions restriction bypass vuln
STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass vulnerability in GNUBoard

STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass

vulnerability in GNUBoard.

Revision 1.0

Date Published: 2004-12-24 (KST)

Last Update: 2005-01-03

Disclosed by SSR Team ( 



GNUBoard is one of widely used web BBS applications in Korea.  However, an

input validation flaw can cause malicious attackers to run arbitrary

commands with the privilege of the HTTPD process, which is typically run as

the nobody user.

Vulnerability Class


Implementation Error: Input validation flaw



High : arbitrary command execution.

Affected Products


GNUBoard 3.40 and prior

Vendor Status: NOT FIXED


2004-12-09 Vulnerability found

2004-12-09 Vendor contacted and confirmed.

2005-01-03 Official release.



Implementation of check every file extension of upload files is

case-sensitive. Bypassing this mechanism, malicious attackers can upload

arbitrary script files (php, pl, cgi, etc) to a web server.

gbupdate.php (107 line)

- ----

// 실행가능한 스크립트 확장자

$source = array ("/\.php/", "/\.htm/", "/\.cgi/", "/\.pl/");

$target = array (".phpx", ".htmx", ".cgix", ".plx");

- ----

gbupdate.php (142 line)

- ----

 // php_x 와 같은 방법으로 스크립트 실행을 하지 못하게 하였으나 abc.php._x

는 실행되는 버그가 있음

 $filename = preg_replace($source, $target, $filename);

 // 접두사를 붙인 파일명

 $upload[$i] = $prefix . $filename;

 $dest_file = "./data/file/$bo_table/$upload[$i]";

- ----

malicious attackers can upload [attack].PHP.rar, [attack].pHp.rar, etc.



modify 108th line of gbupdate.php as following

$source = array ("/\.php/i", "/\.htm/i", "/\.cgi/i", "/\.pl/i");

Vendor URL




Jeremy Bae at STG Security

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH