Psotfx

**Name of the Vulnerable Software and Affected Versions** phpBB version 2.0.6 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary script or HTML. The vulnerable parameters are the `folder` and `mode` variables. **Recommendations** For phpBB version 2.0.6, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the `privmsg.php` file to minimize the risk of exploitation. Avoid using the `folder` and `mode` variables in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: phpBB versions prior to 2.0.11 Description: The issue allows remote attackers to execute arbitrary PHP code by exploiting the improper URL decoding of the `highlight` parameter in the `viewtopic.php` file. This is achieved by double-encoding the `highlight` value, which results in special characters being inserted into the processed result. The vulnerability was exploited by the Santy.A worm. Recommendations: For versions prior to 2.0.11, update to version 2.0.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the `viewtopic.php` file or disabling the `highlight` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** phpBB versions 2.0.6 and earlier **Description** The issue allows group moderators to perform unauthorized activities. This is achieved via the `sql in` parameter in the groupcp.php file. **Recommendations** For phpBB versions 2.0.6 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: phpBB versions 2.0.5 and earlier Description: The issue allows remote attackers to steal password hashes. This is achieved through a SQL injection vulnerability in the viewtopic.php file, specifically via the `topic id` parameter. Recommendations: For phpBB versions 2.0.5 and earlier, update to a version later than 2.0.5 to resolve the issue.