# Author: __GiReX__ 26/07/08
# Homepage: # CMS: IceBB input; $g)
{
...
$where_clauses[] = "{$k}='{$g}'"; qwhere = implode(' AND ',$where_clauses);
$total = $db->fetch_result("SELECT COUNT(*) as total FROM icebb_users{$this->qwhere}{$qextra}"); eatCookie('uid');
$login_key = $std->eatCookie('login_key');$icebb->hooks->hook('login_autoLogin', $uid, $login_key);$userq = $db->query("SELECT u.*,g.* FROM icebb_users AS u LEFT JOIN icebb_groups AS g ON u.user_group=g.gid WHERE u.id=".intval($uid)." AND u.login_key='{$login_key}' LIMIT 1");
$udata = $db->fetch_row($userq);if($db->get_num_rows($userq)>=1)
{
if($std->eatCookie('pass')==$udata['password'])
{
$sessid = md5(uniqid(microtime()));
$ip = $icebb->client_ip;
$user_agent = $std->clean_string($_SERVER['HTTP_USER_AGENT']);//$db->query("DELETE FROM icebb_session_data WHERE username='{$udata['username']}' OR ip='{$ip}'",1);175. $sessdata = $this->create_session($udata['username'],$udata['id'],false,true);
If admin has cookies enabled we can login and create/edit/delete posts and topics.############################### Perl Exploit Start #############################
#!/usr/bin/perl
# IceBB
【IceBB】相关文章：
★ Oracle Internet Directory 10.1.4 Remote Preauth DoS Exploit
★ BIND 9.x Remote DNS Cache Poisoning Flaw Exploit (c)