Description
register.php in S8Forum 3.0 allows remote attackers to execute arbitrary PHP commands by creating a user whose name ends in a .php extension and entering the desired commands into the E-mail field, which creates a web-accessible .php file that can be called by the attacker, as demonstrated using a "system($cmd)" E-mail address with a "any_name.php" username.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- S8Forum 3.0 - Remote Command Execution EDB-22134 · webapps · Jan 6, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 7819 third-party-advisory
- 1005881 vdb-entry
- 6547 vdb-entry
- 20030105 A security vulnerability in S8Forum mailing-list
- s8forum-register-command-execution(10974) vdb-entry
- 20030105 A security vulnerability in S8Forum mailing-list