[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <EFE63B28-6615-467C-82FB-16456899DEAB@gmail.com>
Date: Wed Jun 29 10:13:37 2005
From: andfarm at gmail.com (Andrew Farmer)
Subject: Security Advisory - phpBB 2.0.15 PHP-code
injection bug
On 28 Jun ?05, at 14:47, ronvdaal wrote:
> Proof of concept:
http://some.forum/viewtopic.php?p=postnum&highlight='.die(omghax).'
Uh, whoops.
Another suggested solution:
Remove the highlight handling code in viewtopic.php or replace it
with something that does not use the /e flag to preg_replace. As it
stands, the current code is an abomination that should not have ever
seen the light of day.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050629/e77960e6/PGP.bin
Powered by blists - more mailing lists