PT-2005-2067 · Phpbb · Phpbb

Status-X · Publicado 2005-04-07 · Atualizado 2024-02-14 · CVE-2005-1047

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBB versions 2.0.x

Description The issue concerns a file upload script, specifically the mod for phpBB, which fails to properly restrict the types of files that can be uploaded. This allows remote authenticated users to execute arbitrary commands by uploading PHP files and then directly requesting them from the uploads directory.

Recommendations For phpBB version 2.0.x, consider disabling the file upload functionality in the up.php script until a proper fix is applied to restrict file types to non-executable ones. Restrict access to the uploads directory to prevent direct execution of uploaded files.

Correção

Identificadores relacionados

CVE-2005-1047

Produtos afetados

Phpbb

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-1047 · Nota de Segurança
• http://defacers.com.mx/advisories/2.txt · Nota
• http://marc.info/?l=bugtraq&m=111299353030534&w=2 · Nota
• http://securitytracker.com/id?1013671 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1047 · Nota