{"id":182030,"date":"2026-06-12T02:48:17","date_gmt":"2026-06-12T00:48:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-phpbb-pozvolyayushhaya-poluchit-dostup-k-lyubomu-akkauntu-bez-autentifikaczii"},"modified":"2026-06-12T02:48:17","modified_gmt":"2026-06-12T00:48:17","slug":"uyazvimost-v-phpbb-pozvolyayushhaya-poluchit-dostup-k-lyubomu-akkauntu-bez-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-phpbb-pozvolyayushhaya-poluchit-dostup-k-lyubomu-akkauntu-bez-autentifikaczii","title":{"rendered":"Vulnerabilitet n\u00eb phpBB, i cili lejon akses n\u00eb \u00e7do llogari pa autentifikim","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb motorin e lir\u00eb p\u00ebr krijimin e forumeve phpBB \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi q\u00eb lejon, p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese HTTP, t\u00eb lidhet me seanc\u00ebn e \u00e7do p\u00ebrdoruesi t\u00eb forumit. Dob\u00ebsia shfaqet n\u00eb konfigurimin e phpBB-s\u00eb si\u00e7 \u00ebsht\u00eb paracaktuar. Problemi \u00ebsht\u00eb zgjidhur n\u00eb versionin phpBB 3.3.17.<\/p>\n

Gjat\u00eb nj\u00eb sulmi ndaj p\u00ebrdoruesve t\u00eb zakonsh\u00ebm, mund t\u00eb arrihet qasje n\u00eb bisedat private dhe mund\u00ebsin\u00eb p\u00ebr t\u00eb d\u00ebrguar mesazhe n\u00eb em\u00ebr t\u00eb p\u00ebrdoruesit. Gjat\u00eb nj\u00eb sulmi ndaj moderator\u00ebve dhe administrator\u00ebve, \u00ebsht\u00eb e mundur t\u00eb fshihen mesazhet e t\u00eb tjer\u00ebve, t\u00eb shikohen adresat IP<\/a> dhe email-et, t\u00eb lexohen bisedat private, por nuk mund t\u00eb hyhet n\u00eb nd\u00ebrfaqen e administratorit dhe t\u00eb arrihet qasje n\u00eb host. <\/p>\n

Detajet mbi dob\u00ebsin\u00eb nuk jepen, por me ndihm\u00ebn e AI, metoda e shfryt\u00ebzimit \u00ebsht\u00eb rikonstruktuar duke u bazuar n\u00eb rregullimin e b\u00ebr\u00eb, p\u00ebrmes thirrjes n\u00eb p\u00ebrpunuesin «login_link» me vendosjen e metod\u00ebs s\u00eb autentifikimit «auth_provider=apache» dhe z\u00ebvend\u00ebsimin e emrit t\u00eb p\u00ebrdoruesit p\u00ebrmes Basic Auth, pas s\u00eb cil\u00ebs PHP do t\u00eb vendos\u00eb variabl\u00ebn e mjedisit «PHP_AUTH_USER=emri_p\u00ebrdoruesit», dhe phpBB do ta nxjerr\u00eb emrin e p\u00ebrdoruesit pa verifikimin e fjal\u00ebkalimit. P\u00ebr shembull, p\u00ebr t\u00eb marr\u00eb identifikuesin e sesionit t\u00eb p\u00ebrdoruesit admin dhe ta ruaj at\u00eb n\u00eb skedarin cookies.txt, mund t\u00eb ekzekutohet kodi:<\/p>\n

curl -i -s \
\n -c cookies.txt \
\n -b cookies.txt \
\n -u ‘admin:anything’ \
\n -d ‘login=Login&login_username=admin&login_password=anything’ \
\n ‘https:\/\/target.example\/forum\/ucp.php?mode=login_link&auth_provider=apache&login_link_any=1’
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0444\u043e\u0440\u0443\u043c\u043e\u0432 phpBB \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043e\u0434\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0441\u0435\u0430\u043d\u0441\u0443 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0444\u043e\u0440\u0443\u043c\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 phpBB \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 phpBB 3.3.17. \u041f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0435 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043c\u043e\u0434\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182030","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia n\u00eb phpBB, e cila lejon qasje n\u00eb \u00e7do llogari pa autentifikim | ProHoster","description":"N\u00eb motorin e lir\u00eb p\u00ebr krijimin e forumeve phpBB u zbulua nj\u00eb dob\u00ebsi, e cila lejon t\u00eb lidhet me seanc\u00ebn e \u00e7do p\u00ebrdoruesi t\u00eb forumit p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb HTTP k\u00ebrkese. Dob\u00ebsia shfaqet n\u00eb konfigurimin e phpBB-s\u00eb nga e para. Problemi \u00ebsht\u00eb eliminuar n\u00eb versionin phpBB 3.3.17. Duke sulmuar p\u00ebrdoruesit e zakonsh\u00ebm, mund t\u00eb arrihet akses n\u00eb bisedat private dhe mund\u00ebsit\u00eb p\u00ebr t\u00eb d\u00ebrguar mesazhe n\u00eb em\u00ebr t\u00eb p\u00ebrdoruesit. Duke sulmuar moderator\u00ebt","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-phpbb-pozvolyayushhaya-poluchit-dostup-k-lyubomu-akkauntu-bez-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 phpBB, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043b\u044e\u0431\u043e\u043c\u0443 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0443 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0444\u043e\u0440\u0443\u043c\u043e\u0432 phpBB \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043e\u0434\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0441\u0435\u0430\u043d\u0441\u0443 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0444\u043e\u0440\u0443\u043c\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 phpBB \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 phpBB 3.3.17. \u041f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0435 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043c\u043e\u0434\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-phpbb-pozvolyayushhaya-poluchit-dostup-k-lyubomu-akkauntu-bez-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-12T00:48:17+00:00","article:modified_time":"2026-06-12T00:48:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/182030","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=182030"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/182030\/revisions"}],"predecessor-version":[{"id":182073,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/182030\/revisions\/182073"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=182030"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=182030"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=182030"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}