Home page logo

bugtraq logo Bugtraq mailing list archives

List of all admin accounts in phpBB
From: "Predrag Damnjanovic" <bugtraq () mycity co yu>
Date: Tue, 25 Jan 2005 23:48:20 +0100

After discovering 'highlight' vulnerability in phpBB, many forums 
were patched, but... it is possible that attackers created a [secret] 
admin accounts...
It is very hard to find secret admin accounts if the forum has too 
many users... you must check every account...

So, here is a simple PHP script, that will show a list of all admin 
accounts on your phpBB forum.
Just simply copy this file to phpBB directory...

After you find a attacker admin accounts, and remove admin status 
from those accounts, you can delete this script, and of course, you 
should upgrade your phpBB to the latest version.

A demonstration of this script can be found at

Best regards,
Predrag Damnjanovic

Attachment: admin_list.php

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]