PT-2005-1337 · Phpbb · Phpbb

Published 2005-02-22 · Updated 2008-09-10 · CVE-2005-0259

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpBB versions 2.0.11 and possibly other versions

Description The issue allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file. This is possible when remote avatars and avatar uploading are enabled.

Recommendations For phpBB version 2.0.11, consider disabling the remote avatar and avatar uploading features until a fix is available. As a temporary workaround, restrict access to the avatar upload functionality to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-0259

Affected Products

Phpbb

References · 7

• http://gentoo.org/security/en/glsa/glsa-200503-02.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0259 · Security Note
• http://idefense.com/application/poi/display?id=204&type=vulnerabilities · Vendor Advisory
• http://phpbb.com/support/documents.php?mode=changelog · Vendor Advisory
• http://secunia.com/advisories/14362 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0259 · Note
• http://kb.cert.org/vuls/id/774686 · Note