PT-2005-1336 · Phpbb · Phpbb

Published 2005-02-22 · Updated 2008-09-10 · CVE-2005-0258

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpBB versions 2.0.11 and possibly other versions

Description A directory traversal issue exists, allowing remote attackers to delete arbitrary files. This is achieved by using "/../" sequences in the avatarselect parameter of the "usercp register.php" and "usercp avatar.php" scripts when gallery avatars are enabled.

Recommendations For phpBB version 2.0.11, consider disabling the gallery avatars feature to prevent exploitation until a fix is available. Restrict access to the "usercp register.php" and "usercp avatar.php" scripts to minimize the risk of exploitation. Avoid using the avatarselect parameter in the affected scripts until the issue is resolved.

Fix

Related Identifiers

CVE-2005-0258

Affected Products

Phpbb

References · 5

• http://idefense.com/application/poi/display?id=205&type=vulnerabilities · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200503-02.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0258 · Security Note
• http://phpbb.com/support/documents.php?mode=changelog · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0258 · Note