Waraxe IT Security Portal

LINUX · Moderator

phpBB Attachment Mod Filename Input Validation Error Lets Remote Users View Files on the System

phpBB Attachment Mod Directory Traversal HTTP POST Injection

Affected Packages
-----------------
Attachment module 2.3.10 and earlier

Immune Packages
---------------
Attachment module 2.3.11

1) Visit a website that has attachmod installed in phpBB.
2) Start a new topic, attach a file via the "Add Attachment" input
button.
3) Prior to clicking "Submit", view the page source via your
browser's "View Source".
4) Modify the <FORM> entry if required to send the POST back to the
website.
5) Modify the two values for the input names "attachment_list[]" and
"filename_list[]" from "$oldfilename" to "../../$newfilename".
6) Save the page, load it in your browser, and click "Submit".

An unpatched attachmod site will now have "../../$newfilename" in:

$prefix_attachments_desc.physical_filename
$prefix_attachments_desc.real_filename

And when a user accesses the file via the attachmod download.php
generated link, instead of serving "$filename" from the UPLOAD_DIR
location, it shall serve to the user the "../../$newfilename" if
it exists.

Zeelock · Active user

I discovered this stuff in the middle of october, trying to find a way to change .jpg files on a target host.

The post injection actually is for writing