Mustafa Can Bjorn has discovered a vulnerability in the Nivisec Hacks List module for phpBB, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "phpEx" parameter in admin_hacks_list.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

Example:
http://[host]/admin/admin_hacks_list.php?setmodules=1&board_config[default_lang]=english&phpEx=[file]

Successful exploitation requires that "register_globals" is enabled.

The vulnerability has been confirmed in version 1.20. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised.
Further details available to Secunia VIM customers

Provided and/or discovered by
Mustafa Can Bjorn

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.nukedx.com/?viewdoc=37

Deep Links
Links available to Secunia VIM customers