netVigilance Security Advisory #17
MyBB version 1.2.4 Multiple Path Disclosure Vulnerabilities
MyBB is a powerful, efficient and free forum package developed in PHP and MySQL. Full control over your discussion system is presented right at the tip of your fingers, from multiple styles and themes to the ultimate customisation of your forums using the template system.
Mitre CVE: CVE-2007-0689
NVD NIST: CVE-2007-0689
MyBB is a powerful, efficient and free forum package developed in PHP and MySQL.
Multiple pass disclosure vulnerabilities in the product allow attackers to gather the true path of the server-side script.
Access Vector: Remote
Access Complexity: Low
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
Impact Bias: Normal
CVSS Base Score: 2.33
Target Distribution on Internet: Medium
Exploitability: Functional Exploit
Remediation Level: Workaround
Report Confidence: Confirmed
Vulnerability Impact: Attack
Host Impact: Path disclosure.
SecureScout Testcase ID:
MyBB version 1.2.4
Program flaw - The captcha.php, member.php and event.php scripts has flaws which lead to a Warning or even Fatal Errors.
Contact with the Vendor was established and draft of the security advisory was provided on 11 April 2007, the vendor promised to fix the issue but stopped responding to our emails on 11 April 2007. There is no official fix at the release of this Security Advisory
Disable warning messages: modify in the php.ini file following line: display_errors = Off. Or modify .htaccess file (this will work only for the apache servers).
Path Disclosure Vulnerability 1:
Warning: Illegal offset type in unset in [SERVER_PATH_TO_FILE][mybb-directory]\global.php on line 41
Warning: Cannot modify header information - headers already sent by (output started at [SERVER_PATH_TO_FILE][mybb-directory]\global.php:41) in [SERVER_PATH_TO_FILE][mybb-directory]\inc\functions.php on line 1121
Path Disclosure Vulnerability 2: REQUEST: http://[TARGET]/[mybb-directory]/captcha.php?imagehash=123 REPLY:
Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in [SERVER_PATH_TO_FILE][mybb-directory]\inc\db_mysql.php on line 632
Warning: Division by zero in [SERVER_PATH_TO_FILE][mybb-directory]\captcha.php on line 210
Warning: Cannot modify header information - headers already sent by (output started at [SERVER_PATH_TO_FILE][mybb-directory]\inc\db_mysql.php:632) in [SERVER_PATH_TO_FILE][mybb-directory]\captcha.php on line 114
=89PNG Path Disclosure Vulnerability 3: REQUEST: http://[TARGET]/[mybb-directory]/inc/datahandlers/event.php REPLY:
Fatal error: Class 'DataHandler' not found in [SERVER_PATH_TO_FILE][mybb-directory]\inc\datahandlers\event.php on line 16
Credits: Jesper Jurcenoks Co-founder netVigilance, Inc www.netvigilance.com =09