full-disclosure - Security Advisory - phpBB 2.0.15 PHP-code injection bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed Jun 29 10:13:37 2005
From: andfarm at gmail.com (Andrew Farmer)
Subject: Security Advisory - phpBB 2.0.15 PHP-code
	injection bug

On 28 Jun ?05, at 14:47, ronvdaal wrote:
> Proof of concept:

http://some.forum/viewtopic.php?p=postnum&highlight='.die(omghax).'

Uh, whoops.


Another suggested solution:

Remove the highlight handling code in viewtopic.php or replace it  
with something that does not use the /e flag to preg_replace. As it  
stands, the current code is an abomination that should not have ever  
seen the light of day.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050629/e77960e6/PGP.bin