Secunia

Secunia Research has discovered some vulnerabilities in DeluxeBB, which can be exploited by malicious people to conduct SQL injection attacks and compromise a vulnerable system.

1) Input passed to the "templatefolder" parameter in various scripts isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from external and local resources.

Examples:
http://[host]/templates/deluxe/postreply.php?templatefolder=[file]
http://[host]/templates/deluxe/posting.php?templatefolder=[file]
http://[host]/templates/deluxe/pm/newpm.php?templatefolder=[file]
http://[host]/templates/default/postreply.php?templatefolder=[file]
http://[host]/templates/default/posting.php?templatefolder=[file]
http://[host]/templates/default/pm/newpm.php?templatefolder=[file]

Successful exploitation requires that "register_globals" is enabled.

2) Input passed to the "hideemail", "languagex", "xthetimeoffset", and "xthetimeformat" parameters when registering for an account isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

The vulnerabilities have been confirmed in version 1.06. Other versions may also be affected.

Solution
1) The vulnerabilities have been partially fixed in version 1.07 by filtering the "http:" and "ftp:" fopen wrappers. It is however still possible to include arbitrary files from local resources.
Further details available in Customer Area

Provided and/or discovered by
Andreas Sandblad, Secunia Research

Changelog
Further details available in Customer Area

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2006-44/advisory/

Deep Links
Links available in Customer Area