PHP BB bug

[sasan hezarkhani]

Hello,
i dont know if my foundation is acceptable or not but here we go i post it...

when u right an SQL query in the highlight section of the PHPBB u'll get all of the page highlighted
example :

forums/viewtopic.php?t=[NUMBER HERE]&highlight=Bug,SELECT * FROM $table


Thank You

[Rich Lafferty]

On Sun, Jul 11, 2004 at 11:38:56PM -0000, sasan hezarkhani <gootiker@gmail.com> wrote:
>
>
> Hello,
> i dont know if my foundation is acceptable or not but here we go i post it...
>
> when u right an SQL query in the highlight section of the PHPBB u'll get all of the page highlighted
> example :
>
> forums/viewtopic.php?t=[NUMBER HERE]&highlight=Bug,SELECT * FROM $table

It's highlighting "Bug", "Select", "*", "From", and "$table". But "*"
matches everything. Try:

http://forum.example.com/viewtopic.php?t=[num]&highlight=*

That's exactly how it is intended to work. Not only is it not a security
issue, it's not even a bug.

-Rich

--
Rich Lafferty --------------+-----------------------------------------------
Ottawa, Ontario, Canada | Save the Pacific Northwest Tree Octopus!
http://www.lafferty.ca/ | http://zapatopi.net/treeoctopus.html
rich@lafferty.ca -----------+-----------------------------------------------

[micheal@michealcottingham.com]

Actually, I found that it doesn't matter if an SQL query is there or not=2E=


Example:

http://www=2Eexample=2Ecom/viewtopic=2Ephp?t=3D12345&highlight=3Dbug,%20*

Something like:

http://www=2Eexample=2Ecom/viewtopic=2Ephp?t=3D12345&highlight=3Dbug,*

does not work however=2E There doesn't _appear_ to be any exploit here,
though granted I did not check this a great deal=2E



--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web=2Ecom/ =2E

[Micheal Cottingham]

As per the Project Manager of phpBB, it is an added feature. (I spoke to
him about this already.) There is no exploit or bug.

Christian Jonassen wrote:

>Hmm.
>
>Highlighting everything---what's dangerous about that?
>
> - Christian NJ
>
>On Thu, 15 Jul 2004 16:04:21 -0400, micheal@michealcottingham.com
><micheal@michealcottingham.com> wrote:
>
>
>>Actually, I found that it doesn't matter if an SQL query is there or not.
>>
>>Example:
>>
>>http://www.example.com/viewtopic.php?t=12345&highlight=bug,%20*
>>
>>Something like:
>>
>>http://www.example.com/viewtopic.php?t=12345&highlight=bug,*
>>
>>does not work however. There doesn't _appear_ to be any exploit here,
>>though granted I did not check this a great deal.
>>
>>--------------------------------------------------------------------
>>mail2web - Check your email from the web at
>>http://mail2web.com/ .
>>
>>
>>
>>
>
>
>