الباكر
03-01-2007, 03:03 PM
الثغره
vBulletin <= 3.6.4 inlinemod.php "postids" sql injection / privilege
escalation by session hijacking exploit
by rgod
mail: retrog at alice dot it
site: ---
Works regardless of php.ini settings, you need a Super Moderator account
to copy posts among threads, to be launched while admin is logged in to
the control panel, this will give you full admin privileges
note: this will flood the forum with empty threads even!
-----------------------------------------------------------------------------
');
if ($argc<7) {
print_r('
-----------------------------------------------------------------------------
Usage: php '.$argv[0].' host path user pass forumid postid OPTIONS
host: target server (ip/hostname)
path: path to vbulletin
user/pass: you need a moderator account
forumid: existing forum
postid: existing post
Options:
-p[port]: specify a port other than 80
-P[ip:port]: specify a proxy
Example:
php '.$argv[0].' localhost /vbulletin/ rgod mypass 2 121 -P1.1.1.1:80
php '.$argv[0].' localhost /vbulletin/ rgod mypass 1 143 -p81
الترقيع من الاخ العندليب :
1- إفتح ملف inlinemod.php الموجود داخل مجلد vb
2- ابحث عن:
foreach ($postids AS $index => $postid)
{
if ($postids["$index"] != intval($postid))
{
unset($postids["$index"]);
}
}
استبدلها :
foreach ($postids AS $index => $postid)
{
$postids["$index"]=(int)$postids["$index"];
}
و ابحث عن :
foreach ($threadids AS $index => $threadid)
{
if ($threadids["$index"] != intval($threadid))
{
unset($threadids["$index"]);
}
}
واستبدلها:
foreach ($threadids AS $index => $threadid)
{
$threadids["$index"]=(int)$threadids["$index"];
}
مع الشكر للاخ العندليب
vBulletin <= 3.6.4 inlinemod.php "postids" sql injection / privilege
escalation by session hijacking exploit
by rgod
mail: retrog at alice dot it
site: ---
Works regardless of php.ini settings, you need a Super Moderator account
to copy posts among threads, to be launched while admin is logged in to
the control panel, this will give you full admin privileges
note: this will flood the forum with empty threads even!
-----------------------------------------------------------------------------
');
if ($argc<7) {
print_r('
-----------------------------------------------------------------------------
Usage: php '.$argv[0].' host path user pass forumid postid OPTIONS
host: target server (ip/hostname)
path: path to vbulletin
user/pass: you need a moderator account
forumid: existing forum
postid: existing post
Options:
-p[port]: specify a port other than 80
-P[ip:port]: specify a proxy
Example:
php '.$argv[0].' localhost /vbulletin/ rgod mypass 2 121 -P1.1.1.1:80
php '.$argv[0].' localhost /vbulletin/ rgod mypass 1 143 -p81
الترقيع من الاخ العندليب :
1- إفتح ملف inlinemod.php الموجود داخل مجلد vb
2- ابحث عن:
foreach ($postids AS $index => $postid)
{
if ($postids["$index"] != intval($postid))
{
unset($postids["$index"]);
}
}
استبدلها :
foreach ($postids AS $index => $postid)
{
$postids["$index"]=(int)$postids["$index"];
}
و ابحث عن :
foreach ($threadids AS $index => $threadid)
{
if ($threadids["$index"] != intval($threadid))
{
unset($threadids["$index"]);
}
}
واستبدلها:
foreach ($threadids AS $index => $threadid)
{
$threadids["$index"]=(int)$threadids["$index"];
}
مع الشكر للاخ العندليب