bugtraq - List of all admin accounts in phpBB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 25 Jan 2005 23:48:20 +0100
From: "Predrag Damnjanovic" <bugtraq@...ity.co.yu>
To: bugtraq@...urityfocus.com
Subject: List of all admin accounts in phpBB

After discovering 'highlight' vulnerability in phpBB, many forums 
were patched, but... it is possible that attackers created a [secret] 
admin accounts...
It is very hard to find secret admin accounts if the forum has too 
many users... you must check every account...

So, here is a simple PHP script, that will show a list of all admin 
accounts on your phpBB forum.
Just simply copy this file to phpBB directory...

After you find a attacker admin accounts, and remove admin status 
from those accounts, you can delete this script, and of course, you 
should upgrade your phpBB to the latest version.

A demonstration of this script can be found at
http://www.mycity.co.yu/phpbb/admin_list.php

Best regards,
Predrag Damnjanovic
http://www.mycity.co.yu/

Download attachment "admin_list.php" of type "Application/Octet-stream" (947 bytes)