PT-2005-5033 · Phpbb · Phpbb Blog

Published 2005-12-18 · Updated 2017-07-20 · CVE-2005-4346

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpBB Blog versions 2.2.2 and earlier

Description The issue allows remote attackers to obtain the full path of the application via an invalid permalink parameter to "index.php", which produces an invalid SQL query that leaks the full pathname in a SQL syntax error message. This occurs due to an invalid SQL syntax error in "blog.php".

Recommendations For phpBB Blog versions 2.2.2 and earlier, update to a version that fixes this issue to prevent the disclosure of the application's full path.

Exploit

Fix

Related Identifiers

CVE-2005-4346

Affected Products

Phpbb Blog

References · 5

• 🔥 http://osvdb.org/21565 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4346 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23495 · Note
• http://pridels0.blogspot.com/2005/12/phpbb-blog-222-sql-inj-vuln.html · Note
• http://outshine.com/forums/viewtopic.php?t=308 · Note