PT-2007-1425 · Phpbb · Phpbb Import Tools Mod

Boecke · Publicado 2007-03-07 · Atualizado 2017-10-11 · CVE-2006-7147

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBB Import Tools Mod versions 0.1.4 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the phpbb root path parameter. This is a result of a PHP remote file inclusion vulnerability in the includes/functions mod user.php file.

Recommendations For versions 0.1.4 and earlier, consider restricting access to the phpbb root path parameter to minimize the risk of exploitation. Avoid using the phpbb root path parameter with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2006-7147

Produtos afetados

Phpbb Import Tools Mod

Referências · 4

• 🔥 https://exploit-db.com/exploits/2531 · Exploit
• 🔥 http://securityfocus.com/bid/20525 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-7147 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29512 · Nota