Anonymous Mail Forwarding Vulnerabilities in vBPortal
26 Nov. 2003
Summary
vBPortal is "a add-on to the already popular message board software called vB. vBPortal has came a long way, and the new version 3.0 has a lot of great features and functions. Integrating phpnuke's functions and abilities to easily add modules and add-ons has added greater abilities. Simply it adds a frontpage and utilizes vB's abilities and expands on that".
A vulnerability has been discovered in the friend.php file that allows unauthorized users to send SPAM (junk mail) anonymously.
Both functions SendStory () and SendSite () send emails. Two variables (yname and ymail) are modifiable in the headers. This means that an attacker can inject what he wishes, by using the character LF (line feed), %0A in ASCII.
Exploits: Anonymous Mail Forwarding:
Here is an example of a simple application that changes the mail via variables ymail and fname.
The exploit allows us to choose the sender, the name of the sender, the addressee, type of the message, message, subject, and having the choice between both vulnerable functions.
echo "<br><br><b><a href=\"$url\">Ok, Mail It</a></b>";
}
?>
Let us remind that the user chosen in the request of this exploit will also receive a copy of the mail, this is because an addressee was already defined prior to our additional addressee.
