PT-2005-5033 · Phpbb · Phpbb Blog

Publicado 2005-12-18 · Atualizado 2017-07-20 · CVE-2005-4346

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpBB Blog versions 2.2.2 and earlier

Description The issue allows remote attackers to obtain the full path of the application via an invalid permalink parameter to "index.php", which produces an invalid SQL query that leaks the full pathname in a SQL syntax error message. This occurs due to an invalid SQL syntax error in "blog.php".

Recommendations For phpBB Blog versions 2.2.2 and earlier, update to a version that fixes this issue to prevent the disclosure of the application's full path.

Exploit

Correção

Identificadores relacionados

CVE-2005-4346

Produtos afetados

Phpbb Blog

Referências · 5

• 🔥 http://osvdb.org/21565 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23495 · Nota
• http://pridels0.blogspot.com/2005/12/phpbb-blog-222-sql-inj-vuln.html · Nota
• http://outshine.com/forums/viewtopic.php?t=308 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4346 · Nota de Segurança