A vulnerability has been identified in YaBB SE allowing malicious people to execute arbitrary PHP code on the web server.

The problem is that the "sourcedir" variable in "SSI.php" isn't verfied before it is used in an "include_once" function call. This allows malicious users to supply a path to a remote web server with malicious versions of "Errors.php", "Subs.php" and "Load.php".

Further testing of this vulnerability shows that it can only be reproduced if YaBB SE has not been installed correctly ie. wrong path information or too restrictive file permissions. This is therefore not a vulnerability but a matter of misconfiguration.

Solution
Make sure that YaBB SE has been installed correctly and doesn't return any error messages.

Provided and/or discovered by
Dalibor Karlovic & DownBload

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area