PT-2007-1159 · Phpbb · Phpbb

Cxib8O3 + 1 · Publicado 2007-02-08 · Atualizado 2017-07-20 · CVE-2006-2219

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: phpBB version 2.0.20

Description: The issue allows remote attackers to obtain sensitive information by not verifying user-specified input variable types before being passed to type-dependent functions. This is demonstrated by the mode parameter to "memberlist.php" and the highlight parameter to "viewtopic.php", which are used as an argument to functions such as htmlspecialchars or urlencode, resulting in the display of the installation path in the resulting error message.

Recommendations: For phpBB version 2.0.20, consider updating to a newer version that addresses this issue, as the current version does not properly validate user input, leading to potential information disclosure. As a temporary workaround, consider restricting access to the "memberlist.php" and "viewtopic.php" scripts until a patch is available. Avoid using the mode and highlight parameters in these scripts until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2006-2219

Produtos afetados

Phpbb

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-2219 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26306 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2219 · Nota
• http://marc.info/?l=full-disclosure&m=114685931319903&w=2 · Nota
• http://securityreason.com/securityalert/837 · Nota
• http://marc.info/?l=bugtraq&m=114731067321710&w=2 · Nota
• http://marc.info/?l=bugtraq&m=114695651425026&w=2 · Nota