Secunia

Secunia Research: MyBB "domecode()" PHP Code Execution Vulnerability

======================================================================

                     Secunia Research 12/06/2006

         - MyBB "domecode()" PHP Code Execution Vulnerability -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

======================================================================
1) Affected Software

MyBB 1.1.2

Prior versions may also be affected.

======================================================================
2) Severity

Rating: Highly critical
Impact: System access
Where:  Remote

======================================================================
3) Vendor's Description of Software

MyBB is a powerful, efficient and free forum package developed in PHP 
and MySQL. MyBB has been designed with the end users in mind, you and 
your subscribers. Full control over your discussion system is 
presented right at the tip of your fingers, from multiple styles and 
themes to the ultimate customisation of your forums using the 
template system.

Product link:
http://www.mybboard.com/

======================================================================
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in MyBB, which can be 
exploited by malicious people to compromise a vulnerable system.

Input passed to the username field when registering isn't properly 
sanitised before being used in a "preg_replace" call with the "e" 
modifier in the "domecode()" function in inc/functions_post.php. This 
can be exploited to execute arbitrary PHP code by first registering 
with a specially crafted username and then previewing a post 
containing the "/slap" string.

The vulnerability has been confirmed in version 1.1.2. Prior versions 
may also be affected.

======================================================================
5) Solution

Update to version 1.1.3.
http://www.mybboard.com/downloads.php

======================================================================
6) Time Table

06/06/2006 - Initial vendor notification.
06/06/2006 - Vendor confirms vulnerability.
12/06/2006 - Public disclosure.

======================================================================
7) Credits

Discovered by Andreas Sandblad, Secunia Research.

======================================================================
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned 
CVE-2006-2908 for the vulnerability.

======================================================================
9) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
10) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-40/advisory/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================