phpbb2013user.txt

`------------------------------------------------------------------------  
# phpBB 2.0.13 user level exploit  
# By : Morinex  
# e-mail : [email protected]  
# date : 20-03-2005  
# greetz : Ali7 (for helping me =P) , Zeltha , [code] , ASC and w00pie.NL  
  
Exploit not founded by me!  
Dunno who is the founder of this bug.  
The original not works so i have fixed the some shit.  
  
*Spechial thx 2 the founder of this bug*  
  
  
This one goes for all phpBB versions up to 2.0.13. While applying and  
testing the  
patch for the autologin bug I found that phpBB2 doesn't reset the  
$userdata['user_level']  
variable after a failed autologin.  
  
This is the vulvernable code in sessions.php:  
  
Code:  
f ( $user_id != ANONYMOUS )  
{  
$auto_login_key = $userdata['user_password'];  
  
if ( $auto_create )  
{  
if ( isset($sessiondata['autologinid']) && $userdata['user_active'] )  
{  
// We have to login automagically  
if( $sessiondata['autologinid'] === $auto_login_key )  
{  
// autologinid matches password  
$login = 1;  
$enable_autologin = 1;  
}  
else  
{  
// No match; don't login, set as anonymous user  
$login = 0;  
$enable_autologin = 0;  
$user_id = $userdata['user_id'] = ANONYMOUS;  
}  
}  
else  
{  
// Autologin is not set. Don't login, set as anonymous user  
$login = 0;  
$enable_autologin = 0;  
$user_id = $userdata['user_id'] = ANONYMOUS;  
}  
}  
else  
{  
$login = 1;  
}  
}  
else  
{  
$login = 0;  
$enable_autologin = 0;  
}  
  
  
As you can see, if autologin fails it will reset the  
$userdata['user_id'] value to  
ANONYMOUS, but $userdata['user_level'] stays at the value of the user  
account that  
failed to login.  
  
Now phpBB only checks for the userlevel in various locations and  
ignores the user_id  
there. So if you manipulate the "_data" cookie to send the user_id of an admin  
you can see some information that should only be visible to an admin.  
Like hidden  
users on the "who is online page" or email adresses from users, even if the  
user disallowed that, in their profiles. Maybe you can even use some  
admin functions,  
I didn't check this in depth.  
  
The cookie manipulation will only work on the first page requestet, as  
the session.php  
will then overwrite the user_id in it, unless you prevent the browser from  
modifying the cookie of course.  
  
The fix is quite simple, add $userdata['user_level'] = USER; after  
every $userdata['user_id']  
= ANONYMOUS; in session.php.  
  
*Reported 2 PHPBB ^^  
  
  
Morinex  
`