List of all admin accounts in phpBB

["Predrag Damnjanovic" <bugtraq () mycity co yu>]

After discovering 'highlight' vulnerability in phpBB, many forums 
were patched, but... it is possible that attackers created a [secret] 
admin accounts...
It is very hard to find secret admin accounts if the forum has too 
many users... you must check every account...

So, here is a simple PHP script, that will show a list of all admin 
accounts on your phpBB forum.
Just simply copy this file to phpBB directory...

After you find a attacker admin accounts, and remove admin status 
from those accounts, you can delete this script, and of course, you 
should upgrade your phpBB to the latest version.

A demonstration of this script can be found at
http://www.mycity.co.yu/phpbb/admin_list.php

Best regards,
Predrag Damnjanovic
http://www.mycity.co.yu/

Attachment: admin_list.php
Description: