PT-2006-1689 · Phpbb · Phpbb

Publicado 2006-02-10 · Atualizado 2018-10-19 · CVE-2006-0632

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpBB version 2.0.19

Description The issue concerns the generation of activation keys, also known as "validation IDs", which are sent via email when setting up a password. The gen rand string function uses insufficiently random data, making it easier for remote attackers to guess the key. This could allow attackers to modify passwords for existing accounts or create new accounts.

Recommendations For phpBB version 2.0.19, consider updating to a newer version that addresses this issue, as the current implementation of the gen rand string function poses a significant risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-0632

Produtos afetados

Phpbb

Referências · 8

• 🔥 http://r-security.net/tutorials/view/readtutorial.php?id=4 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0632 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24573 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0632 · Nota de Segurança
• http://secunia.com/advisories/18727 · Nota
• http://securityfocus.com/archive/1/424074/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/0461 · Nota
• http://osvdb.org/22949 · Nota