re: II-Labs Advisory: Remote code execution in YaBBse 1.5.2 (php version)

["Frog Man" <leseulfrog () hotmail com>]

A message has been published on BugTraq by DownBload 
(http://www.securityfocus.com/archive/1/320997/2003-05-07/2003-05-13/0) 
about an include vulnerabilty in Yabb SE 1.5.2 (the last version).

This solution :
-----------------------------------------------------------------------------------------------

======[ Solution

Add this line before include_once() lines mentioned above.

----cut here----
if (!isset($sourcedir)) $sourcedir = "";
----cut here----

-----------------------------------------------------------------------------------------------
doesn't change anything for the security.
A good solution could be :

--------------------------------------------------------------
if (file_exists($sourcedir.'/Errors.php')){
include_once ($sourcedir . '/Errors.php');
include_once ($sourcedir . '/Subs.php');
include_once ($sourcedir . '/Load.php');
}else{
die("Bad path.");
}
--------------------------------------------------------------


A patch will be (I hope :)) soon downloadable on http://www.phpsecure.info
The author of this message, a friend, has been alerted.

frog-m@n

_________________________________________________________________