Exploit-DB #3971
Description: NavBoard 2.6.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2007-05-23
Author: Dj7xpl

Exploit:
<?php

/*
        \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo---------------------------------------------------

[ Y! Underground Group ]
[   Dj7xpl@yahoo.com   ]
[    Dj7xpl.2600.ir    ]

----ooooO-----Ooooo--------------------------------------------------
    (   )     (   )
     \ (       ) /
      \_)     (_/

---------------------------------------------------------------------

[!] Portal        :   NavBoard 2.6.0
[!] Download      :   http://www.sourceforge.net/projects/navboard
[!] Type          :   Remote Code Execution Exploit

---------------------------------------------------------------------
*/

/*
Vuln Code :

[Code]

if(!$editconfig){

 tableheader1();
 print "<form action=\"admin_config.php\" method=post>";
 print "<input type=hidden name=\"editconfig\" value=\"1\" size=40>"; 
 print "<tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";
 print "<b>Main forum settings</b>";
 print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Board Title";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 print "<input type=text name=\"boardtitle\" value=\"$configarray[0]\" size=40 class=\"forminput\">";
 print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Admin email address (blank will not display)";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 print "<input type=text name=\"adminemail\" value=\"$configarray[35]\" size=40 class=\"forminput\">";
 print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Main website address (NOT forum address, blank will display forum address)";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 print "<input type=text name=\"mainwebsite\" value=\"$configarray[36]\" size=40 class=\"forminput\">";
 print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Display text title instead of graphic logo for faster loading<br>";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 if($configarray[34]=="on")
 {print "<input type=checkbox name=\"textlogo\" class=\"forminput\" checked>";}
 else{print "<input type=checkbox name=\"textlogo\" class=\"forminput\">";}
 print "</span></td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";
 
 print "<b>Forums</b><br>";
 print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Max levels of subforums to display on one page (less will make for faster loading)<br>";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 print "<input type=text name=\"maxsubforumdisplay\" value=\"$configarray[27]\" size=2 class=\"forminput\">";
 print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Don't find forum reply count on the fly, recount during posting<br>(faster forum page, may slow posting slightly)";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 if($configarray[42]=="on"){
 print "<input type=checkbox name=\"dontscanreplycount\" class=\"forminput\" checked>";
 }else{print "<input type=checkbox name=\"dontscanreplycount\" class=\"forminput\">";}
 print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Forum/Thread indenting amount<br>Percentage of title cell used for indent spaing";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 print "<input type=text name=\"indentspacing\" value=\"$configarray[44]\" size=2 class=\"forminput\">%";
 print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";
 
 print "<b>Posts</b><br>";
 print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Seconds before user may add another post (flood control)";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 print "<input type=text name=\"postfloodcontrolsec\" value=\"$configarray[37]\" size=2 class=\"forminput\">";
 print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Amount of nested bbcodes allowed<br>(how many times a bbcode tag can be put over itself) 3 is default";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 print "<input type=text name=\"nestedbbcodes\" value=\"$configarray[43]\" size=2 class=\"forminput\">";
 print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Show names for user levels instead of imageicons:<br>";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 if($configarray[45]=="on"){
 print "<input type=checkbox name=\"userlevelnames\" class=\"forminput\" checked>";
 }else{
 print "<input type=checkbox name=\"userlevelnames\" class=\"forminput\">";
 }
 print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Show all edits instead of only last edit on posts<br>";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 if($configarray[46]=="on"){
 print "<input type=checkbox name=\"showalledits\" class=\"forminput\" checked>";
 }else{
 print "<input type=checkbox name=\"showalledits\" class=\"forminput\">";
 }
 print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";
 
 print "<b>Registration</b><br>";
 print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Seconds before another account can be registered (flood control)<br>";
 print "</span></td><td class=\"tablecell2\" width=\"50%\">";
 print "<input type=text name=\"regfloodcontrolsec\" value=\"$configarray[38]\" size=2 class=\"forminput\">";
 print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";
 print "Method of