PT-2005-2067 · Phpbb · Phpbb

Status-X · Published 2005-04-07 · Updated 2024-02-14 · CVE-2005-1047

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBB versions 2.0.x

Description The issue concerns a file upload script, specifically the mod for phpBB, which fails to properly restrict the types of files that can be uploaded. This allows remote authenticated users to execute arbitrary commands by uploading PHP files and then directly requesting them from the uploads directory.

Recommendations For phpBB version 2.0.x, consider disabling the file upload functionality in the up.php script until a proper fix is applied to restrict file types to non-executable ones. Restrict access to the uploads directory to prevent direct execution of uploaded files.

Fix

Related Identifiers

CVE-2005-1047

Affected Products

Phpbb

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-1047 · Security Note
• http://securitytracker.com/id?1013671 · Vendor Advisory
• http://defacers.com.mx/advisories/2.txt · Note
• http://marc.info/?l=bugtraq&m=111299353030534&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1047 · Note