Security Focus meldt dat iemand het voor elkaar gekregen heeft om tussen de extreem ranzige en trage perl code van het populaire Ultimate Bulletin Board (nog steeds in gebruik op ons eigen forum) een bugje te vinden:
Infopop's Ultimate Bulletin Board software (often referred to as UBB) is a popular web board package written in perl. Because of errors in regular expressions that check form input values, it is possible to execute arbitrary commands on a server running UBB. In ubb_library.pl, the variable $ThreadFile is added to the end of a string passed to the open() call (as a filepath) for writing data to the UBB web server's filesystem. Regular expressions are used to make sure the variable data is in proper format:if ($ThreadFile =~ /\d\d\d\d\d\d\.ubb/)
and in the commercial version:
if ($ThreadFile =~ /\d\d\.[m|n|ubb|cgi]/) { Unfortunately, the regular expressions do not require that ".ubb" be the end of the strings, which means that extra data can be included after ".ubb" and the value will still match the expressions (if $ThreadFile is crafted properly) and be passed to open(). The value for $Threadfile is obtained directly from a "hidden" html form variable called 'topic', making this a remotely exploitable vulnerability.
Thanks xoror voor de link.
:strip_icc():strip_exif()/u/2487/crop5e47f66e4deec_cropped.jpeg?f=community){kind=small}
/u/1/femme.png?f=community){kind=small}
:strip_exif()/u/2043/313546.gif?f=community){kind=small}
:strip_exif()/u/2869/minipad.gif?f=community){kind=small}