Justin Roy PunPortal module prior 1.0 login.php pun_user[language] path traversal

Summaryinfo

A vulnerability identified as problematic has been detected in Justin Roy PunPortal module. This affects an unknown function of the file login.php. The manipulation of the argument pun_user[language] leads to path traversal. This vulnerability is listed as CVE-2008-5418. In addition, an exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Justin Roy PunPortal module and classified as problematic. This issue affects some unknown functionality of the file login.php. The manipulation of the argument pun_user[language] with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Directory traversal vulnerability in login.php in the PunPortal module before 2.0 for PunBB allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pun_user[language] parameter.

The weakness was presented 12/10/2008 (Website). It is possible to read the advisory at milw0rm.com. The identification of this vulnerability is CVE-2008-5418 since 12/10/2008. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

A public exploit has been developed by StAkeR in Perl and been published even before and not after the advisory. The exploit is available at securityfocus.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 20 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:login.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (46774), Exploit-DB (7168) and SecurityFocus (BID 32380†). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Justin Roy

Name

• PunPortal module

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion