PT-2004-2443 · Phpbb · Phpbb

Jerome Athias · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1535

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBB Cash Mod module (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary PHP code by modifying the phpbb root path parameter to reference a URL on a remote web server that contains the code. This is achieved through a remote file inclusion vulnerability in the admin cash.php file for the Cash Mod module.

Recommendations For the Cash Mod module, consider restricting access to the admin cash.php file until a patch is available. As a temporary workaround, avoid using the phpbb root path parameter to reference external URLs.

Exploit

Fix

Related Identifiers

CVE-2004-1535

Affected Products

Phpbb

References · 6

• 🔥 https://exploit-db.com/exploits/24751 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1535 · Security Note
• http://marc.info/?l=bugtraq&m=110082153702843&w=2 · Note
• http://marc.info/?l=bugtraq&m=110075903308817&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1535 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18151 · Note