PT-2005-5044 · Phpbb · Phpbb

Cxib8O3 + 1 · Published 2005-12-20 · Updated 2018-10-19 · CVE-2005-4358

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpBB version 2.0.18

Description The issue allows remote attackers to obtain the installation path of phpBB. This is achieved by making a direct request to the 'admin/admin disallow.php' endpoint with a non-empty setmodules parameter. The request causes an invalid append sid function call, resulting in the installation path being leaked in an error message.

Recommendations For phpBB version 2.0.18, consider restricting access to the 'admin/admin disallow.php' endpoint until a fix is available. As a temporary workaround, avoid using the setmodules parameter in requests to this endpoint to minimize the risk of path disclosure.

Fix

Related Identifiers

CVE-2005-4358

Affected Products

Phpbb

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2005-4358 · Security Note
• http://secunia.com/advisories/18252 · Vendor Advisory
• http://secunia.com/advisories/18125 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4358 · Note
• http://securityfocus.com/archive/1/420537/100/0/threaded · Note
• http://osvdb.org/21804 · Note
• http://phpbb.com/phpBB/viewtopic.php?f=14&t=352966 · Note
• http://marc.info/?l=full-disclosure&m=113484567432679&w=2 · Note
• http://securityreason.com/achievement_securityalert/29 · Note
• http://vupen.com/english/advisories/2005/2991 · Note
• http://securityreason.com/securityalert/269 · Note
• http://vupen.com/english/advisories/2006/0010 · Note