################################################
Mercuryboard 1.0.x & 1.1.x debug information disclosure
vendor url: http://www.mercuryboard.com
advisore:http://lostmon.blogspot.com/2005/02/
mercuryboard-debug-information.html
OSVDB ID:13787
exploit avaible :yes vendor: emailed
Secunia:SA14284
Securitytracker:1013626
################################################
MercuryBoard is a powerful message board system dedicated to raw speed with a mixture of features, ease of use, and ease of customization coupled with expandability, and diverse language services
Mercuryboard contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a any user manipulates the imputs in the url and added \&debug=1 at url or concatenate &debug=1, occurs, which will disclose all sql querys ,all files are in use ,path disclosure, and what templates used this information resulting in a loss of confidentiality.
afected versions :
1.0.x
1.1.x
1.1.3 not afected
Proof of concept
http://[target]/index.php?a=forum&f=\&debug=1
http://[target]/index.php?a=\&debug=1
http://[target]/index.php?a=&debug=1
http://[target]/index.php?a=forum&debug=1
http://[target]/index.php?c=&debug=1
impact:
Loss of confidenciality
Information disclosure
path disclosure
imput manipulation.
solution:
need to update tu version 1.1.3 this issue is solved in this version
release time :
Discovered : 2005-02-13
Email to vendor: 2005-02-13
disclosure date: 2005-02-14
updated : 2005-04-02
Atentamente:
Lostmon (lostmon@gmail.com)
Thnx to estrella Ke tailoviu un monton :P
thnx to http://www.hispanew.com for support.
http://Lostmon.blogsport.com/
--
La curiosidad es lo que hace mover la mente....
Subscribe to:
Posts (Atom)