phpBB成员列表搜索及私人消息附件绕过安全限制漏洞

BUGTRAQ ID: 28790 CVECAN ID: CVE-2008-1766 phpBB是非常流行的WEB论坛程序。 phpBB没有对成员列表功能实施充分的访问限制，如果攻击者拥有有效的用户凭据并能够查看成员列表页面的话，就可以通过邮件地址搜索成员列表，这样就通过地址连接到了帐号。 phpBB没有对PM附件功能实施充分的访问限制，如果攻击者拥有有效的用户凭据、可以查看PM系统中的附件并知道附件ID的话，就可以查看其他用户的附件。 phpBB Group phpBB 3.0.0 phpBB Group -----------...

CVE-2008-1766

Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."...

Design/Logic Flaw

Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."...

CVE-2008-1766

Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."...

CVE-2008-1766

phpBB 3.0.x before 3.0.1 contains multiple information-disclosure vulnerabilities, linked to two minor security bugs. An attacker with valid credentials could potentially disclose member emails by searching the member list and access other users’ PM attachments by knowing attachment IDs. A patch ...

CVE-2008-1766

Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."...

phpBB Add-on Fishing Cat Portal Remote File Inclusion Exploit

No description provided by source. html head meta http-equiv="Content-Type" content="text/html; charset=windows-1254" titleFishing Cat Portal Addon functionsportal.php Remote File Inclusion Exploit/title script language="JavaScript" //'Bug found and Exploit coded by bd0rk //'Vendor:...

phpBB Add-on Fishing Cat Portal Remote File Inclusion Exploit

Exploit for unknown platform in category web applications ============================================================= phpBB Add-on Fishing Cat Portal Remote File Inclusion Exploit ============================================================= Fishing Cat Portal Addon functionsportal.php Remote...

phpBB Fishing Cat Portal Addon - functions_portal.php Remote File Inclusion

phpBB Fishing Cat Portal Addon - functionsportal.php Remote File Inclusion source: https://www.securityfocus.com/bid/28708/info Fishing Cat Portal Addon for phpBB is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue ca...

phpBB Addon Fishing Cat Portal - Remote File Inclusion

Fishing Cat Portal Addon functionsportal.php Remote File Inclusion Exploit //'Bug found and Exploit coded by bd0rk //'Vendor: http://www.foxymods-phpbb.com/ //'Download: http://www.foxymods-phpbb.com/download.php?id=7 //'Contact: bd0rkathackermail.com //'Vulnerable Code in line 21:...

phpBB Fishing Cat Portal Addon - 'functions_portal.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/28708/info Fishing Cat Portal Addon for phpBB is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue can allow an attacker to compromise the application and the underlying system...

Directory traversal

Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary local files via a .. dot dot in the phpEx parameter...

CVE-2008-1565

PJIRC 0.5 module for phpBB is affected by a directory traversal vulnerability in forum/irc/irc.php, exploitable via a .. in the phpEx parameter to include and execute local files. This is a remote (network) issue with partial confidentiality, integrity, and availability impact as stated. The CVE ...

pjirc-lfi.txt

/ PJIRC mod phpBB Local File Include Discrovered by: 0in from DaRk-CodeRs Programming & Security Group! Contact: 0indotemailatgmaildotcom Description: This is a simply irc applet to phpbb. Download: http://www.hotscripts.pl/produkt-1998.html HTTP://Dark-Coders.4rh.eu Greetz to: All DaRk-CodeRs Te...

phpBB PJIRC mod LFI

/ PJIRC mod phpBB Local File Include Discrovered by: 0in from DaRk-CodeRs Programming & Security Group! Contact: 0indotemailatgmaildotcom Description: This is a simply irc applet to phpbb. Download: http://www.hotscripts.pl/produkt-1998.html HTTP://Dark-Coders.4rh.eu Greetz to: All DaRk-CodeRs Te...

CVE-2008-1512

Directory traversal vulnerability in admin/adminxs.php in eXtreme Styles module XS-Mod 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and execute arbitrary files via a .. dot dot in the phpEx parameter. NOTE: some of these details are obtained from third party information...

Directory traversal

Directory traversal vulnerability in admin/adminxs.php in eXtreme Styles module XS-Mod 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and execute arbitrary files via a .. dot dot in the phpEx parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-1512

Directory traversal vulnerability in admin/adminxs.php in eXtreme Styles module XS-Mod 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and execute arbitrary files via a .. dot dot in the phpEx parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-1512

CVE-2008-1512 affects the eXtreme Styles (XS-Mod) for phpBB, specifically XS-Mod versions 2.3.1 and 2.4.0. The vulnerability is a directory traversal in admin/admin_xs.php that allows remote attackers to include and execute arbitrary files by manipulating the phpEx parameter (using ..). The issue...

phpBB PJIRC Module 0.5 - irc.php Local File Inclusion

phpBB PJIRC Module 0.5 - irc.php Local File Inclusion source: https://www.securityfocus.com/bid/28446/info The PJIRC module for phpBB is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability using...