After discovering 'highlight' vulnerability in phpBB, many forums were patched, but... it is possible that attackers created a [secret] admin accounts... It is very hard to find secret admin accounts if the forum has too many users... you must check every account... So, here is a simple PHP script, that will show a list of all admin accounts on your phpBB forum. Just simply copy this file to phpBB directory... After you find a attacker admin accounts, and remove admin status from those accounts, you can delete this script, and of course, you should upgrade your phpBB to the latest version. A demonstration of this script can be found at http://www.mycity.co.yu/phpbb/admin_list.php Best regards, Predrag Damnjanovic http://www.mycity.co.yu/
Attachment:
admin_list.php
Description: Binary data
