PT-2005-4215 · Phpbb · Phpbb

Stefan Esser · Published 2005-11-01 · Updated 2016-10-18 · CVE-2005-3419

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBB version 2.0.17

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the signature bbcode uid parameter in the usercp register.php file, which is not properly initialized.

Recommendations For phpBB version 2.0.17, consider restricting access to the usercp register.php file until a proper fix is applied, and ensure that all parameters, including signature bbcode uid, are properly sanitized to prevent SQL injection attacks.

Fix

Related Identifiers

CVE-2005-3419

DSA-925-1

Affected Products

Phpbb

References · 12

• http://securityfocus.com/bid/15243 · Patch
• http://securitytracker.com/id?1015121 · Vendor Advisory
• http://debian.org/security/2005/dsa-925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3419 · Security Note
• http://osvdb.org/20390 · Patch
• http://hardened-php.net/advisory_172005.75.html · Vendor Advisory
• http://secunia.com/advisories/18098 · Note
• http://marc.info/?l=bugtraq&m=113081113317600&w=2 · Note
• http://securityreason.com/securityalert/130 · Note
• http://vupen.com/english/advisories/2005/2250 · Note
• http://secunia.com/advisories/17366 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3419 · Note