Re: phpBB <= 2.0.12 UID Exploit
From: Nicob (nicob_at_nicob.net)
To: email@example.com, firstname.lastname@example.org Date: Wed, 02 Mar 2005 10:46:23 +0100
federico gonzales wrote :
> I made this exploit for get admin permissions in forums phpbb2 2.0.12.
> It requires mozilla or firefox installed. The instructions are in the
Platform and browser independent exploit in 3 lines of Bean-Shell. Use
this code in WebScarab, and don't forget to desactivate the "Get cookies
from responses" option.
response = fetchResponse(request);
Note #1 : because of some additional checks for the /admin/ pages, you
should desactivate the BeanShell before following the admin link.
Note #2 : this code tries to get userid=2 privs. Edit it at will ...