phpBB-IE-gif.txt

phpBB 2.0.17 and other BB systems as well Cookie disclosure exploit. I sent the report to phpBB and they said that a patch will be available withing a few days and It will be integrated into 2.0.18 . Note: This works like XSS, and requires the victim to use IE Affects all versions of IE. Special...

CVE-2005-3310

The CVE-2005-3310 issue affects phpBB2 (v2.0.17) where remote authenticated users can inject arbitrary web script/HTML via HTML files with a GIF/JPEG extension when remote avatars and avatar uploads are enabled, leading to cross-site scripting on viewed pages. Root cause: interpretation errors in...

CVE-2005-3310

Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet...

[SA17295] phpBB Avatar Script Insertion Vulnerability

TITLE: phpBB Avatar Script Insertion Vulnerability SECUNIA ADVISORY ID: SA17295 VERIFY ADVISORY: http://secunia.com/advisories/17295/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: phpBB 2.x http://secunia.com/product/463/ DESCRIPTION: K-Gen has discovered a...

phpbb -- multiple vulnerabilities

Multiple vulnerabilities have been reported within phpbb. phpbb is proven vulnerable to: script insertion, bypassing of protetion mechanisms, multiple cross site scripting vulnerabilities, SQL injection, arbitrary code execution...

[Full-disclosure] phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.

phpBB 2.0.17 and other BB systems as well Cookie disclosure exploit. I sent the report to phpBB and they said that a patch will be available withing a few days and It will be integrated into 2.0.18 . Note: This works like XSS, and requires the victim to use IE Affects all versions of IE. Special...

r57phpbb_admin2exec.pl.txt

!/usr/bin/perl r57phpbbadmin2exec.pl phpBB adminstyles.php commands execution exploit tested on phpBB 2.0.13 by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru screen r57phpbbadmin2exec.pl -p http://blah.com/phpBB/admin/ -s 0864cb0abb396319c589ebc2a98c2c5d -c getprefix...

phpBB 2.0.13 - admin_styles.php Remote Command Execution

phpBB 2.0.13 - adminstyles.php Remote Command Execution !/usr/bin/perl r57phpbbadmin2exec.pl phpBB adminstyles.php commands execution exploit tested on phpBB 2.0.13 by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru screen r57phpbbadmin2exec.pl -p http://blah.com/phpBB/admin/ -s...

phpBB 2.0.13 (admin_styles.php) Remote Command Execution Exploit

Exploit for linux platform in category remote exploits ================================================================ phpBB 2.0.13 adminstyles.php Remote Command Execution Exploit ================================================================ !/usr/bin/perl r57phpbbadmin2exec.pl phpBB...

phpBB 2.0.13 (admin_styles.php) Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl r57phpbbadmin2exec.pl phpBB adminstyles.php commands execution exploit tested on phpBB 2.0.13 by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru screen r57phpbbadmin2exec.pl -p http://blah.com/phpBB/admin/ -s 0864cb0abb396319c589ebc2a98c2c5d -c...

phpBB 2.0.13 - 'admin_styles.php' Remote Command Execution

!/usr/bin/perl r57phpbbadmin2exec.pl phpBB adminstyles.php commands execution exploit tested on phpBB 2.0.13 by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru screen r57phpbbadmin2exec.pl -p http://blah.com/phpBB/admin/ -s 0864cb0abb396319c589ebc2a98c2c5d -c getprefix...

phpBB 2.0.17 remote avatar size bug

Title: phpBB remote avatar size bug Software: phpBB 2.0.17 and maybe prior versions Discovered by: David Sopas Ferreira david at systemsecure dot org Original link: http://www.systemsecure.org/ssforum/viewtopic.php?t=272 » Email from phpBB « Your report "Avatar size" has been closed because your...

multiVulns.txt

Multi-CMS/Forum Vulnability's Found by ap0c hackers pacifico & ratboy Yo! Ok, well a couple new vulnabilitys have been found by.. us : ------------------ First; e107 xss--- ------------------ link=http://w000000w00tw00t/asdadLIlink= onMouseOver='alertdocument.cookie;'...

Multiple CMS/Forum Vulnablilties

Multi-CMS/Forum Vulnability's Found by ap0c hackers pacifico & ratboy Yo! Ok, well a couple new vulnabilitys have been found by.. us : ------------------ First; e107 xss--- ------------------ link=http://w000000w00tw00t/asdadLIlink= onMouseOver='alertdocument.cookie;' h1d3="size=24HIGHLIGHT...

bbcodeLogout.txt

Hi, Saw this one on www.waraxe.us Discovered by Easyex and i was thinking if there are some more possibilities using the method described. The POC below is for phpBB. - ========== make yourself a folder on your host rename the folder to signature.jpg this will trick bbcode that its an image file...

[Full-disclosure] BBCode [IMG] [/IMG ] Tag Vulnerability

Hi, Saw this one on www.waraxe.us Discovered by Easyex and i was thinking if there are some more possibilities using the method described. The POC below is for phpBB. - ========== make yourself a folder on your host rename the folder to signature.jpg this will trick bbcode that its an image file...

CVE-2004-2358

Cross-site scripting XSS vulnerability in adminwords.php for phpBB 2.0.6c allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2004-2350

SQL injection vulnerability in search.php for phpBB 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the searchresults parameter...

CVE-2004-2358

CVE-2004-2358 describes a cross-site scripting (XSS) vulnerability in the phpBB 2.0.6c admin_words.php script, allowing remote attackers to inject arbitrary web script or HTML via the id parameter. The vulnerability details indicate the affected component is phpBB’s admin_words.php and the flaw a...

CVE-2004-2350

The CVE-2004-2350 entry pertains to an SQL injection in phpBB’s search.php affecting phpBB 1.0 through 2.0.6 via the search_results parameter. The underlying vulnerability allows remote attackers to execute arbitrary SQL and potentially gain privileges, as described in the fixed-text CVE descript...